CVE-2018-11562: Improper Neutralization of Input During Web Page Generation

An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter...

CVE-2017-3961

Cross-Site Scripting XSS vulnerability in the web interface in McAfee Network Security Management NSM before 8.2.7.42.2 allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via crafted user input of attributes...

PT-2018-2867 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a heap-based buffer overflow in the ext4 xattr set entry function, located in fs/ext4/xattr.c. This could be exploited by an attacker operating on a mounted...

Cross site scripting

app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes...

CVE-2018-11245

app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes...

CVE-2018-11245

app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes...

CVE-2018-11245

app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes...

CVE-2018-11245

app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes...

PT-2018-10423 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP version 2.4.91 Description: The issue is related to a DOM-based XSS in the app/webroot/js/misp.js file, specifically with cortex type attributes. Recommendations: For MISP version 2.4.91, update to a newer version that contains a fix for...

CVE-2018-11245: Improper Neutralization of Input During Web Page Generation

app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes...

Cross-Site Scripting

Overview All versions of react-marked-markdown are vulnerable to cross-site scripting XSS via href attributes. This is exploitable if user is provided to react-marked-markdown Proof of concept: import React from 'react' import ReactDOM from 'react-dom' import MarkdownPreview from...

Shopify: Improper access check by Kit leads to controlling attributes of store & getting analytics by deleted Store member via dual messenger A/C

Hi, Disclaimer : - This report will be detected as a duplicate of a N/A marked report by me351154.The reason for self-close was i did not know if the scope in your policy only restricted to XSS,CSRF on kitcrm.com the domain. Issue : - A deleted store member can still use Kit via Facebook messenge...

Open-AudIT Professional - 2.1.1 - Cross-Site Scripting

Open-AudIT Professional - 2.1.1 - Cross-Site Scripting Exploit Title: Open-AudIT Professional 2.1.1 – Multiple Cross-Site Scripting Exploit Author: Tejesh Kolisetty Vendor Homepage: https://opmantek.com/ Software Link: https://opmantek.com/network-tools-download/ Affected Version: 2.1.1 Category:...

End of support for Office 2013

End of support for Office 2013 Support for Office 2013 ended on April 11, 2023 and there will be no extension and no extended security updates. All of your Office 2013 apps will continue to function. However, you could expose yourself to serious and potentially harmful security risks.Buy or try...

Description of the security update for Word 2010: May 8, 2018

Description of the security update for Word 2010: May 8, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common...

Description of the security update for SharePoint Server 2010: May 8, 2018

Description of the security update for SharePoint Server 2010: May 8, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see the following...

Google Chrome Cross-Border Access Vulnerability

Google Chrome is a web browser developed by the American company Google Google. Google Chrome suffers from an out-of-bounds access vulnerability. An attacker can exploit this vulnerability to cause out-of-bounds reads and writes, resulting in inline fields e.g., lastIndex being changed to...

rails-html-sanitizer Cross-site Scripting vulnerability

There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications...

PT-2018-3106 · Blender Foundation +1 · Blender +1

Name of the Vulnerable Software and Affected Versions: Blender version 2.78c Description: An integer overflow exists in the upgrade of a legacy Mesh attribute of the Blender open-source 3d creation suite. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow...

CVE-2018-3741

There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications...