Cross site scripting

A remote stored xss vulnerability was discovered in HPE KVM IP Console Switches versions: G2 4x1Ex32 Prior to 2.8.3...

CVE-2020-24628

A remote code injection vulnerability was discovered in HPE KVM IP Console Switches versions: G2 4x1Ex32 Prior to 2.8.3...

CVE-2020-24628

CVE-2020-24628 affects HPE KVM IP Console Switches (G2 4x1Ex32) prior to version 2.8.3. The issue is described as a remote code injection vulnerability. Supported documents confirm the affected product family and version range; no root-cause technical details or patch/mitigation are provided in t...

CVE-2020-24627

CVE-2020-24627: A remote stored cross‑site scripting vulnerability affecting HPE KVM IP Console Switches (G2 4x1Ex32) prior to 2.8.3. Documents confirm the vulnerability type (XSS) and affected product/versions, but do not provide concrete root-cause details or explicit exploitation steps. No rem...

CVE-2020-24627

A remote stored xss vulnerability was discovered in HPE KVM IP Console Switches versions: G2 4x1Ex32 Prior to 2.8.3...

Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2020-8164).

Summary There is a vulnerability in Ruby On Rails that is used by IBM License Metric Tool. Vulnerability Details CVEID: CVE-2020-8164 DESCRIPTION: Ruby on Rails could allow a remote attacker to obtain sensitive information, caused by the deserialization of untrusted data. By sending a specially...

Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ

It was found that Hawtio console does not set HTTPOnly or Secure attributes on cookies. An attacker could use this flaw to rerieve an authenticated user's SessionID, and possibly conduct further attacks with the permissions of the authenticated user...

VulnCheck KEV: CVE-2018-14665

A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root...

The vulnerability of VMware Fusion, Horizon Client for Mac, and VMware Remote Console for Mac lies in the insecure management of privileges, allowing an attacker to elevate their privileges to the root level.

The vulnerability of VMware Fusion, Horizon Client for Mac, and VMware Remote Console for Mac is related to insecure management of privileges. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level...

Amazon Linux 2 : kernel (ALAS-2020-1495)

The version of kernel installed on the remote host is prior to 4.14.198-152.320. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1495 advisory. In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and...

CVE-2020-13658

In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privileges within the application...

CVE-2020-13658

In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privileges within the application...

Cross site request forgery (csrf)

In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privileges within the application...

Lansweeper Cross-Site Request Forgery Vulnerability

Lansweeper is an IT asset management system from Lansweeper Belgium. The system includes features such as IT asset discovery and network settings scanning. A cross-site request forgery vulnerability exists in Lansweeper version 8.0.130.17. The vulnerability stems from the vulnerability of the web...

HPESBHF04044 rev.2 - HPE IP Console Switch G2 4x1Ex32, Remote Stored XSS and Code Injection.

Potential Security Impact: Remote: script injection, persistent cross site scripting SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE KVM IP Console Switches G2 4x1Ex32 Prior to 2.8.3 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2020-24627 |...

kernel: out-of-bounds read in in vc_do_resize function in drivers/tty/vt/vt.c

A flaw was found in the Linux kernel’s virtual console resize functionality. An attacker with local access to virtual consoles can use the virtual console resizing code to gather kernel internal data structures...

kernel: invalid read location in vgacon_invert_region function in drivers/video/console/vgacon.c

A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console. An out-of-bounds read can occur, leaking information to the console...

kernel: out-of-bounds read in in vc_do_resize function in drivers/tty/vt/vt.c

A flaw was found in the Linux kernel’s virtual console resize functionality. An attacker with local access to virtual consoles can use the virtual console resizing code to gather kernel internal data structures...

kernel: invalid read location in vgacon_invert_region function in drivers/video/console/vgacon.c

A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console. An out-of-bounds read can occur, leaking information to the console...

CVE-2020-13658

CVE-2020-13658 affects Lansweeper 8.0.130.17 where the web console is vulnerable to a CSRF attack that enables a low-privilege user to elevate privileges within the application. The vulnerability arises from insufficient CSRF protection in the web interface, leading to unauthorized privilege esca...