Cross site scripting

Cross Site Scripting XSS vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user execute arbitrary code...

CVE-2020-21345: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user execute arbitrary code...

PT-2021-10613

Name of the Vulnerable Software and Affected Versions: Halo version 1.1.3 Description: The issue is related to a Cross Site Scripting XSS vulnerability, which allows a remote malicious user to execute arbitrary code via post publish components in the manage panel. Recommendations: For Halo versio...

CVE-2021-29952

When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code. This vulnerability affects Firefox 88.0.1 and Firefox for Android 88.1.3...

Security Bulletin: Vulnerability affects Watson Explorer Foundational Components (CVE-2021-23840)

Summary Security vulnerability affects IBM Watson Explorer Foundational Components. Vulnerability Details CVEID: CVE-2021-23840 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an integer overflow in CipherUpdate. By sending an overly long argument, an attacker could exploit...

EFB Tampering 3. Take-off pt2

Take-off Performance Part 2: Flap, Trim, Database and Sources of Data Target: FLAP SETTING There are various forms of flaps and slats. The difference between the two and the technicalities of how they work is outside the scope of this blog. As a general rule flaps extend from the rear/trailing ed...

Rockwell Automation Connected Components Workbench Path Traversal Vulnerability

Rockwell Automation CCW is an HMI editor and component-level industrial product for designing and configuring applications and performing microcontroller turns. A path traversal vulnerability exists in Rockwell Automation Connected Components Workbench, which can be exploited by an attacker to...

PT-2021-7290

Name of the Vulnerable Software and Affected Versions Rockwell Automation Connected Components Workbench versions prior to 12.00.00 Description The issue is related to the parsing mechanism of certain file types, which lacks input sanitization for file paths. This could allow an attacker to creat...

Rockwell Automation Connected Components Workbench code issues and vulnerabilities

Rockwell Automation CCW is an HMI editor and component-level industrial product for designing and configuring applications and performing microcontroller turns. A deserialization vulnerability exists in Rockwell Automation Connected Components Workbench, which can be exploited by an attacker to...

Rockwell Automation Connected Components Workbench path traversal vulnerability

Rockwell Automation CCW is an HMI editor and component-level industrial product for designing and configuring applications and performing microcontroller turns. An input validation error vulnerability exists in Rockwell Automation Connected Components Workbench, which can be exploited by an...

Rockwell Automation Connected Components Workbench path traversal vulnerability

Rockwell Automation CCW is an HMI editor and component-level industrial product for designing and configuring applications and performing microcontroller turns. A path traversal vulnerability exists in Rockwell Automation Connected Components Workbench, which can be exploited by an attacker to...

Rockwell Automation Connected Components Workbench

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: Connected Components Workbench Vulnerabilities: Deserialization of Untrusted Data, Path Traversal, Improper Input Validation 2. RISK EVALUATION Successful exploitation of...

Ubuntu: Security Advisory (USN-4942-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: A vulnerability in the IBM® SDK, Java™ Technology Edition affects IBM Tivoli Network Manager CVE-2020-14782.

Summary A vulnerability exists in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Manager IP Edition v4.2, which was disclosed in the Oracle October 2020 Critical Patch Update, but deferred until the release associated with the IBM February 2021 Critical Patch...

PT-2021-3139 · Microsoft · Sharepoint Server +1

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Foundation affected versions not specified Microsoft SharePoint Enterprise Server affected versions not specified Description: The issue is related to errors in...

USN-4942-1: Firefox vulnerability

A race condition was discovered in Web Render Components. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code...

USN-4942-1 firefox vulnerability

A race condition was discovered in Web Render Components. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code...

com.googlecode.wicketelements:wicket-elements-components (1.4.8), com.googlecode.wicketelements:wicket-elements-library (1.4.8) +214 more potentially affected by CVE-2020-11976 via org.apache.wicket:wicket-core (1.5.3)

org.apache.wicket:wicket-core MAVEN version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.wicket:wicket-core and may be impacted: - com.googlecode.wicketelements:wicket-elements-components 1.4.8 -...

com.googlecode.wicketelements:wicket-elements-components (>=1.4.9, <=1.4.10), com.googlecode.wicketelements:wicket-elements-library (>=1.4.9, <=1.4.10) +191 more potentially affected by CVE-2020-11976 via org.apache.wicket:wicket-core (1.5.4)

org.apache.wicket:wicket-core MAVEN version 1.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.wicket:wicket-core and may be impacted: - com.googlecode.wicketelements:wicket-elements-components =1.4.9, =1.4.9, =1.4.9, =1.4.9, =1.4.9,...

com.danhaywood.isis.wicket:danhaywood-isis-wicket-excel (>=1.2.0, <=1.3.0), com.danhaywood.isis.wicket:danhaywood-isis-wicket-fullcalendar (1.2.0) +238 more potentially affected by CVE-2020-11976 via org.apache.wicket:wicket-core (6.7.0)

org.apache.wicket:wicket-core MAVEN version 6.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.wicket:wicket-core and may be impacted: - com.danhaywood.isis.wicket:danhaywood-isis-wicket-excel =1.2.0, =1.2.0, =1.2.1 -...