5569 matches found
The FAA Is Arguing for Security by Obscurity
In a proposed rule by the FAA, it argues that software in an Embraer S.A. Model ERJ 190-300 airplane is secure because it's proprietary: In addition, the operating systems for current airplane systems are usually and historically proprietary. Therefore, they are not as susceptible to corruption...
CVE-2017-9505
Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments add...
Multiple Open Redirect Vulnerabilities
Moodle is vulnerable to multiple open redirect vulnerabilities. The vulnerabilities exist because of insufficient filtering of return URLs on some pages, leading to redirection to other arbitrary sites. It can also result in phishing attacks through 1 backup/backupfilesedit.php, 2...
XXE Vulnerability in Various TRS Products
WCM, Portal, infogate plug-ins, comment plug-ins, etc. developed by Topsy, widely used in the national government, enterprises and institutions portal system and plug-ins. TRS a variety of products mainly including: WCM, Portal, infogate plug-ins, comment plug-ins exist XXE entity injection...
INFOR EAM 11.0 Build 201410 - Persistent Cross-Site Scripting via Comment Fields
INFOR EAM 11.0 Build 201410 - Persistent Cross-Site Scripting via Comment Fields Stored XSS in INFOR EAM V11.0 Build 201410 via comment fields ------------------- Assigned CVE: CVE-2017-7953 Reproduction steps: ------------------- 1. Log in with your EAM account 2. Go to the jobs page 3. Click on...
INFOR EAM 11.0 Build 201410 - Persistent Cross-Site Scripting via Comment Fields Vulnerability
Exploit for multiple platform in category web applications Stored XSS in INFOR EAM V11.0 Build 201410 via comment fields ------------------- Assigned CVE: CVE-2017-7953 Reproduction steps: ------------------- 1. Log in with your EAM account 2. Go to the jobs page 3. Click on a record and open its...
INFOR EAM 11.0 Build 201410 - Persistent Cross-Site Scripting via Comment Fields
Stored XSS in INFOR EAM V11.0 Build 201410 via comment fields ------------------- Assigned CVE: CVE-2017-7953 Reproduction steps: ------------------- 1. Log in with your EAM account 2. Go to the jobs page 3. Click on a record and open its page 4. Go to "Comments" tab 4. Click the add new comment...
Design/Logic Flaw
INFOR EAM V11.0 Build 201410 has XSS via comment fields...
CVE-2017-7953
INFOR EAM V11.0 Build 201410 has XSS via comment fields...
CVE-2017-7953
INFOR EAM V11.0 Build 201410 has XSS via comment fields...
CVE-2017-7953: Improper Neutralization of Input During Web Page Generation
INFOR EAM V11.0 Build 201410 has XSS via comment fields...
PT-2017-18025
Name of the Vulnerable Software and Affected Versions INFOR EAM version 11.0 Build 201410 Description The issue is related to a security problem where an attacker can inject malicious code via comment fields, potentially leading to unauthorized actions on the affected system. Recommendations For...
PT-2017-4258 · Gnome +5 · Libcroco +5
Name of the Vulnerable Software and Affected Versions: libcroco version 0.6.12 Description: The issue is related to the cr tknzr parse comment function in the cr-tknzr.c component of the libcroco library, which can cause a denial of service due to a memory allocation error when processing a craft...
XXE Vulnerability in TRS Comment Plugin
TRS Comment plug-in developed by Topsy, widely used in the national government, enterprises and institutions portal of the general-purpose plug-ins. TRS Comment plug-in synchannel Servlet XXE vulnerability, an attacker can use the vulnerability to read any file on the server, traversing the serve...
Code injection
GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element...
CVE-2017-8780
GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element...
CVE-2017-8780
GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element...
CVE-2017-8780
GeniXCMS 1.0.2 is affected by a cross-site scripting (XSS) vulnerability triggered by a comment mishandled during an administrator publish operation, demonstrated by a malformed P element. Root cause and impact are described across multiple sources (NVD/NVD, Red Hat, GHSA, OSV, CNVD, CNVD). The d...