CVE-2019-16178

A stored cross-site scripting XSS vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page...

CVE-2019-16178

A stored cross-site scripting XSS vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page...

CVE-2019-16178: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page...

PT-2019-14558

Name of the Vulnerable Software and Affected Versions Limesurvey versions prior to 3.17.14 Description A stored cross-site scripting issue was discovered that allows authenticated users with the correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home...

Updated ghostscript packages fix security vulnerability

Updated ghostscript packages fix security vulnerability: It was found that the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate...

MGASA-2019-0236 Updated ghostscript packages fix security vulnerability

Updated ghostscript packages fix security vulnerability: It was found that the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate...

CVE-2019-15497

Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP...

Default credentials

Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP...

CVE-2019-15497

CVE-2019-15497 affects Black Box iCOMPEL 9.2.3 through 11.1.4 (as used in ONELAN Net-Top-Box 9.2.3–11.1.4 and other products). The root cause described is default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP . Impact is consistent with the NVD m...

CVE-2019-15497

Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP...

PT-2019-14225

Name of the Vulnerable Software and Affected Versions Black Box iCOMPEL versions 9.2.3 through 11.1.4 ONELAN Net-Top-Box versions 9.2.3 through 11.1.4 Description The issue allows remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP due to default credentials. Recommendations...

CVE-2019-15497: Use of Hard-coded Credentials

Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP...

KDDI Smart TV Box Access Control Error Vulnerability

KDDI Smart TV Box is a smart TV box from KDDI Japan. An Access Control Error vulnerability exists in KDDI Smart TV Boxes using firmware versions prior to 1300, which stems from the program's failure to restrict access rights and can be exploited by remote attackers to perform arbitrary operations...

JVN#17127920: Smart TV Box fails to restrict access permissions

Smart TV Box provided by KDDI CORPORATION enables access to Android Debug Bridge via port 5555/TCP of LAN side interface. When a cable television provider sets up Smart TV Box at an individual residence, direct access from outside to the LAN side interface of Smart TV Box is disabled. However if...

CVE-2019-15233

The Live:Text Box macro in the Old Street Live Input Macros app before 2.11 for Confluence has XSS, leading to theft of the Administrator Session Cookie...

CVE-2019-15233

CVE-2019-15233 affects the Live:Text Box macro in Old Street Live Input Macros for Confluence, with XSS in versions before 2.11 that can steal an Administrator session cookie. The issue arises from injected JavaScript in a Confluence element, enabling session hijacking when a page containing the ...

PT-2019-14029

Name of the Vulnerable Software and Affected Versions Old Street Live Input Macros app versions prior to 2.11 for Confluence Description The issue concerns the Live:Text Box macro in the Old Street Live Input Macros app, which has a cross-site scripting XSS problem. This can lead to the theft of...

WordPress Meta Box Plugin < 4.16.2 File Upload Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112628";...

WordPress Meta Box Plugin < 4.16.3 File Deletion Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112627";...

PT-2019-11230

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform Central Management Console versions 4.1, 4.2, 4.3 Description: The issue allows an attacker to store a malicious payload within the description field of a user account. This payload is...