CVE-2018-11076

Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0 and 7.4.1 and Dell EMC Integrated Data Protection Appliance IDPA 2.0 are affected by an information exposure vulnerability. Avamar Java management console's SSL/TLS private key may be leaked in the Avamar Java management client...

Code injection

JTBCPHP 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter...

CVE-2018-19547

JTBCPHP 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter...

CVE-2018-19546

JTBCPHP 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter...

CVE-2018-19546

JTBCPHP 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter...

CVE-2018-19547

CVE-2018-19547 affects JTBC(PHP) 3.0.1.7 with a reflected/stored XSS in the console/xml/manage.php?type=action&action=edit content parameter. The root cause is an improper handling of the content parameter in that endpoint, enabling injection of arbitrary JavaScript/HTML. The connected documents ...

Oracle Secure Global Desktop Administration Console 4.4 Cross Site Scripting Vulnerability

Oracle Secure Global Desktop Administration Console version 4.4 build 20080807152602 suffers from cross site scripting vulnerabilities. alert"XSS" helpFile=concepts.html&pageTitle=Administrator Help&mastheadUrl=/images/productNameSecondaryMasthead.png&mastheadDescription=Sun Secure Global Desktop...

JTBC (PHP) Cross-Site Request Forgery Vulnerability (CNVD-2018-26794)

JTBC PHP is an open source CMS Content Management System. A cross-site request forgery vulnerability exists in JTBC PHP version 3.0.1.7. A remote attacker can exploit this vulnerability to perform unauthorized operations with the help of console/xml/manage.php?type=action&action=edit URI...

Xorg X11 Server SUID Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Xorg X11 Server SUID privilege escalation', 'Description' = %q This module attempts to gain root privileges with SUID Xorg X11 server versions...

Oracle Secure Global Desktop Administration Console 4.4 Cross Site Scripting

alert"XSS" helpFile=concepts.html&pageTitle=Administrator Help&mastheadUrl=/images/productNameSecondaryMasthead.png&mastheadDescription=Sun Secure Global Desktop Administration&jspPath=/sgdadmin/faces/comsunwebui/help/&mastheadHeight=40&mastheadWidth=20 Vulnerables parameters: windowTitle,...

Cross site scripting

The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS...

CVE-2018-14935

The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS...

CVE-2018-14935

The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS...

CVE-2018-14935

The CVE-2018-14935 entry maps to a web-based XSS in the Web administration console of Polycom Trio devices running software before 5.5.4. Affected component: the web admin UI. Root cause: reflected/scripted input in the console without proper encoding. Impact: user-facing XSS could affect confide...

Veeam Availability Console U1 Cumulative Patch 1850

Challenge Veeam Availability Console U1 Cumulative Patch 1850. This update supersedes Veeam Availability Console U1 Cumulative Patch 1824. Cause Please confirm you are running version 2.0.2.1750 or later prior to installing this cumulative patch 1850. You can check this under Windows Programs and...

CVE-2018-6081

XSS vulnerabilities in Interstitials in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension or open Developer Console to inject arbitrary scripts or HTML via a crafted HTML page...

UBUNTU-CVE-2018-6081

XSS vulnerabilities in Interstitials in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension or open Developer Console to inject arbitrary scripts or HTML via a crafted HTML page...

CVE-2018-6081

XSS vulnerabilities in Interstitials in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension or open Developer Console to inject arbitrary scripts or HTML via a crafted HTML page...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Security Key Lifecycle Manager (SKLM) (CVE-2018-1770)

Summary IBM WebSphere Application Server is shipped as a component of IBM Security Key Lifecycle Manager SKLM. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulleti...

Authentication flaw

Authentication bypass in the Intel RAID Web Console 3 for Windows before 4.186 may allow an unprivileged user to potentially gain administrative privileges via local access...