CVE-2018-12411

The CVE-2018-12411 issue affects TIBCO ActiveSpaces Administrative Daemon (tibdgadmind) across Community, Developer, and Enterprise Editions. The root cause is a cross-site request forgery (CSRF) vulnerability that could enable an attacker to gain administrative access, including actions like del...

CVE-2018-12411

The administrative daemon tibdgadmind of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks...

CVE-2018-12412

The realm server tibrealmserver component of TIBCO Software Inc. TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks. Affected releases are TIBCO...

CVE-2018-12413

The Schema repository server tibschemad component of TIBCO Software Inc.'s TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition contains a vulnerability which may allow an...

Cross site request forgery (csrf)

The administrative daemon tibdgadmind of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks...

Cross site request forgery (csrf)

The realm server tibrealmserver component of TIBCO Software Inc. TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks. Affected releases are TIBCO...

TIBCO Security Advisory: November 6, 2018 - TIBCOActiveSpaces

TIBCO ActiveSpaces Administrative Daemon Vulnerable to CSRF Attacks Original release date: November 6, 2018 Last revised: CVE-2018-12411 Source: TIBCOSoftware Inc. TIBCO ActiveSpaces Administrative Daemon Vulnerable to CSRF Attacks Original release date: November 6, 2018 Last revised: Source: TIB...

OrientDB Studio web management interface is vulnerable to clickjacking attacks

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

OrientDB-Server vulnerable to Cross-Site Request Forgery

The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery CSRF attacks, and obtain sensitive information, via a crafted HTTP...

SugarCRM Community Edition Cross-Site Scripting Vulnerability

SugarCRM Community Edition is an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing for different customer needs, managing and distributing sales leads, and enabling information sharing and tracking of sales representatives. A...

UBUNTU-CVE-2018-16049

An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Disclosure in Sidekiq Logs through an Error Message...

UBUNTU-CVE-2018-16051

An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Orphaned Upload Files Exposure...

CVE-2018-16051

Affected product: GitLab Community and Enterprise Edition prior to 11.0.6, 11.1.x prior to 11.1.5, and 11.2.x prior to 11.2.2. Issue: Orphaned Upload Files Exposure. Root cause: exposure of orphaned uploaded files. Impact: potential exposure of uploaded file data. Remediation: upgrade to fixed re...

UBUNTU-CVE-2018-12606

An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature...

CVE-2018-12606

An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature...

Qualys Helps Smaller Organizations Secure Hybrid IT with Free Offering

The digital transformation revolution waits for -- and spares -- no one. It forces all businesses to adopt tech innovations, like cloud, IoT and mobility, and to protect the resulting IT environments as they become hybrid, distributed and elastic. With traditional network perimeters dissolved,...

GitLab CE and EE Denial of Service Vulnerabilities

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing the contents of a project's files, commit history, bug lists, and more. A denial-of-service...

GitLab CE and EE Cross-Site Scripting Vulnerability (CNVD-2019-06641)

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing the contents of a project's files, commit history, bug lists, and more. A cross-site scriptin...

GitLab CE and EE Cross-Site Scripting Vulnerabilities

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing the contents of a project's files, commit history, bug lists, and more. A cross-site scriptin...

Open-AudIT Cross-Site Scripting Vulnerability (CNVD-2018-12810)

Open-AudIT is a network discovery and auditing program. The program intelligently scans networks and network devices and provides status reports. A cross-site scripting vulnerability exists in the Attributes feature in versions of Open-AudIT Community Edition prior to 2.2.2. A remote attacker can...