Cross site scripting

html-janitor node module suffers from a Cross-Site Scripting XSS vulnerability via clean accepting user-controlled values...

CVE-2017-0931

html-janitor node module suffers from a Cross-Site Scripting XSS vulnerability via clean accepting user-controlled values...

Regular Expression Denial Of Service (ReDoS)

clean-css is vulnerable to regular expression denial of service ReDoS attacks. The vulnerability exists due to the use of a vulnerable regex pattern where using it to match a malicious string could result in a ReDoS attack...

The installer of Visual C++ Redistributable may insecurely load Dynamic Link Libraries

Overview The installer of Visual C++ Redistributable provided Microsoft contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries in the same directory as the installer CWE-427. Microsoft states that the root cause of this vulnerability is "Applicatio...

Cross-Site Scripting

Overview Versions of html-janitor prior to 2.0.2 all current versions are vulnerable to cross-site scripting XSS. This is exploitable if user-controlled data is passed into the modules clean function. Recommendation No fix is currently available for this vulnerability. It is recommended to use an...

[SECURITY] Fedora 28 Update: python-django-2.0.3-1.fc28

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

[SECURITY] Fedora 27 Update: python-django-1.11.11-1.fc27

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

undertow: IO thread DoS via unclean Websocket closing

It was found that with non-clean TCP close, Websocket server gets into infinite loop on every IO thread, effectively causing DoS...

Python Scriptable Reverse Engineering Sandbox: PyREBox

PyREBox is a Python scriptable Reverse Engineering sandbox. It is based on QEMU, and its goal is to aid reverse engineering by providing dynamic analysis and debugging capabilities from a different perspective. PyREBox allows to inspect a running QEMU VM, modify its memory or registers, and to...

StoreFront management console fails to open after upgrading, or clean installation of StoreFront 3.12.x (7.15 LTSR)

StoreFront management console fails to open when upgrading StoreFront 3.12.7.15 LTSR to StoreFront 3.12.x7.15 LTSR CUx, or after a clean installation of StoreFront 3.12.X7.15 LTSR. In these situations, attempting to start the StoreFront management console displays the following errors: In the...

How to Clean Install macOS High Sierra – Includes installing macOS from a USB device

Along with the upgrade of Mac OS X, its name has also changed to High Sierra. Due to Apple’s restrictions, some older Macs cannot be upgraded to the latest macOS High Sierra. You may want to install a completely new macOS. This article explains how to clean install the macOS High Sierra. First we...

cleanpowernet.de XSS vulnerability

Open Bug Bounty ID: OBB-565248 Description| Value ---|--- Affected Website:| cleanpowernet.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

[SECURITY] Fedora 27 Update: python-django-1.11.10-1.fc27

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

Fedora 27 : xen (2017-333ea49a63)

xen: various flaws 1490884 Missing NUMA node parameter verification XSA-231, CVE-2017-14316 Missing check for grant table XSA-232, CVE-2017-14318 cxenstored: Race in domain cleanup XSA-233, CVE-2017-14317 insufficient grant unmapping checks for x86 PV guests XSA-234, CVE-2017-14319 Note that...

DEBIAN-CVE-2017-17866

pdf/pdf-write.c in Artifex MuPDF before 1.12.0 mishandles certain length changes when a repair operation occurs during a clean operation, which allows remote attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impact via a crafted PDF...

CVE-2017-17792

BlogoText (CMS) contains a Cross-site scripting (XSS) flaw in the markup_clean_href function, inc/conv.php, up to version 3.7.6. The root cause is improper handling in markup_clean_href that allows remote attackers to inject arbitrary JavaScript via a comment, as described in multiple sources (NV...

WordPress Clean Up Optimizer 4.0.0 SQL Injection Vulnerability

WordPress Clean Up Optimizer plugin versions 4.0.0 and below suffer from a remote SQL injection vulnerability. Advisory Title: WordPress Clean Up Optimizer Plugin Security Vulnerability Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress Clean Up Optimizer plugin Language:...

WordPress Clean Up Optimizer 4.0.0 SQL Injection

DefenseCode ThunderScan SAST Advisory: WordPress Clean Up Optimizer Plugin Security Vulnerability Advisory ID: DC-2017-12-004 Advisory Title: WordPress Clean Up Optimizer Plugin Security Vulnerability Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress Clean Up Optimizer...

WordPress Clean Up & Optimizer – Clean Up Optimizer plugin <=4.0.12 - SQL injection (SQLi) vulnerability

SQL injection SQLi vulnerability found by Neven Biruski in WordPress Clean Up & Optimizer – Clean Up Optimizer plugin versions =4.0.12. Solution Update the WordPress Clean Up & Optimizer – Clean Up Optimizer plugin to the latest available version at least 4.0.13...

Tidy prvTidyTidyMetaCharset Function Denial of Service Vulnerability

Tidy is the United States of America's World Wide Web Consortium W3C researcher Dave Raggett developed a used to correct and clean up the HTML file errors and neatly arrange the code i.e., indentation of the software and function libraries. A denial of service vulnerability exists in the...