Craft CMS Information Disclosure Vulnerability (CNVD-2019-24876)

Craft CMS is a content management system CMS. An information disclosure vulnerability exists in Craft CMS version 2 prior to 2.7.10 and version 3 prior to 3.2.6. The vulnerability stems from an error in configuration or other errors in the operation of a networked system or product. An unauthoriz...

PT-2019-13581

Name of the Vulnerable Software and Affected Versions Craft 2 versions prior to 2.7.10 Craft 3 versions prior to 3.2.6 Description The issue potentially exposes personal or geolocation data to the public due to the failure to strip EXIF data from user-uploaded images when configured to do so...

CVE-2019-14280: Exposure of Sensitive Information to an Unauthorized Actor

In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public...

CVE-2019-12804

In Hunesion i-oneNet version 3.0.7 3.0.53 and 4.0.4 4.0.16, due to the lack of update file integrity checking in the upgrade process, an attacker can craft malicious file and use it as an update...

CVE-2019-12980

In Ming aka libming 0.4.8, there is an integer overflow caused by an out-of-range left shift in the SWFInputreadSBits function in blocks/input.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted swf file...

Craft CMS Cross-Site Scripting Vulnerability (CNVD-2019-18754)

Craft CMS is a content management system CMS. A cross-site scripting vulnerability exists in Craft CMS version 3.1.30. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit the vulnerability to execute client-side code...

CVE-2019-12823

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

CVE-2019-12823

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

Cross site scripting

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

CVE-2019-12823

Craft CMS before 3.1.31 is vulnerable to cross-site scripting due to improper filtering of XML feeds. Affects Craft CMS core XML feed handling; attacker could inject and execute client-side scripts. CVSS metrics indicate MEDIUM severity (CVSS 3.1 base 6.1) with network access, no privileges requi...

CVE-2019-12823

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

CVE-2019-12823

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

CVE-2019-12823: Improper Neutralization of Input During Web Page Generation

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

PT-2019-12967

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 3.1.31 Description The issue is related to the improper filtering of XML feeds, which allows for cross-site scripting XSS attacks. This means that an attacker could potentially inject malicious code into the XML fee...

CVE-2018-13381: Improper Restriction of Operations within the Bounds of a Memory Buffer

A buffer overflow vulnerability in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.7, 5.4 and earlier versions and FortiProxy 2.0.0, 1.2.8 and earlier versions under SSL VPN web portal allows a non-authenticated attacker to perform a Denial-of-service attack via special craft message...

Excerpts from “5 Questions for Eric O’Neil—the FBI “ghost” who brought down a Russian Mole”

Eric O’Neill serves as Carbon Black’s national security strategist where he is a thought leader on a wide range of issues including counterterrorism and national security matters. Prior to this, he was as an operative for the FBI, where he conducted national security field operations against...

Electro-Craft IQ Position Controller IQ DeviceNet Adapter

Binary data 754806.prm...

CVE-2019-11068

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded...

Apache Axis 1.4 Remote Code Execution

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Apache Axis 1.4 Remote Code Execution CVE-2019-0227 https://rhinosecuritylabs.com/Application-Security/CVE-2019-0227-Expired-Domain-to-RCE-in-Apache-Axis Author: David Yesland @daveysec, Rhino...

CVE-2019-9718

In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ffhtmlmarkuptoass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf...