Remote Code Execution

spoon/library is vulnerable to remote code execution. Lack of validation of the cookie allows a remote attacker to submit a cookie containing malicious executable objects that will execute upon deserialization in the wakeup magic method in spoon/cookie/cookie.php...

Node.js third-party modules: [node-red] Stored XSS within Flow's - "Name" field

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report Stored XSS in...

openSUSE Security Update : python (openSUSE-2019-1989)

This update for python fixes the following issues : - CVE-2018-20852: Fixed an information leak where cookies could be send to the wrong server because of incorrect domain validation bsc1141853. This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc...

S-CMS Enterprise Website Builder System b***.php page has xss vulnerability

S-CMS enterprise station building system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise station building solutions for the product. The S-CMS b.php page has an xss vulnerability, which can be exploited by an attacker to obtain administrator cookies...

openSUSE: Security Advisory for python (openSUSE-SU-2019:1988-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for python (moderate)

openSUSE Security Update: Security update for python Announcement ID: openSUSE-SU-2019:1988-1 Rating: moderate References: 1141853 Cross-References: CVE-2018-20852 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This update for python...

XSS Vulnerability in Mailbox 189

189 mailbox is a new type of mailbox for all Internet users, with 380 million registered users. It is ranked among the top three mailboxes in the domestic mailbox industry, only after NetEase and QQ mailboxes. There is an XSS vulnerability in 189 mailbox, which can be exploited by attackers to...

DRUPAL-CONTRIB-2019-065

This module that allows you to store external images on your server and apply your own Image Styles. The module exposes cookies to external sites when making external image requests. This vulnerability is mitigated by using the whitelisted host feature to restrict external image requests from...

Imagecache External - Critical - Insecure session token management - SA-CONTRIB-2019-065

This module that allows you to store external images on your server and apply your own Image Styles. The module exposes cookies to external sites when making external image requests. This vulnerability is mitigated by using the whitelisted host feature to restrict external image requests from...

Kaspersky Antivirus Flaw Exposed Users to Cross-Site Tracking Online

In this digital era, the success of almost every marketing, advertising, and analytics company drives through tracking users across the Internet to identify them and learn their interests to provide targeted ads. Most of these solutions rely on 3rd-party cookies, a cookie set on a domain other th...

CVE-2019-1172

An information disclosure vulnerability exists in Azure Active Directory AAD Microsoft Account MSA during the login request session. An attacker who successfully exploited the vulnerability could take over a user's account. To exploit the vulnerability, an attacker would have to trick a user into...

SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2019:2114-1)

This update for python fixes the following issues : CVE-2018-20852: Fixed an information leak where cookies could be send to the wrong server because of incorrect domain validation bsc1141853. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

Amazon Linux 2 : python (ALAS-2019-1258)

A security regression of CVE-2019-9636 was discovered in python, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is...

CVE-2019-14731

An issue was discovered in ZenTao 11.5.1. There is an XSS stored vulnerability that leads to the capture of other people's cookies via the Rich Text Box...

Cross site scripting

An issue was discovered in ZenTao 11.5.1. There is an XSS stored vulnerability that leads to the capture of other people's cookies via the Rich Text Box...

CVE-2019-14731

An issue was discovered in ZenTao 11.5.1. There is an XSS stored vulnerability that leads to the capture of other people's cookies via the Rich Text Box...

CVE-2019-14731

CVE-2019-14731 affects ZenTao 11.5.1 with a stored XSS in the Rich Text Box that can lead to capture of other users’ cookies. Connected sources describe the issue as XSS (stored) in ZenTao 11.5.1 and note lack of input validation in the related web UI/WEB application as a contributing factor (e.g...

CVE-2019-14550

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which would fire when a user clicks on the Edit Dashboard button, thus...

CVE-2019-14549

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible...

CVE-2019-14550

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which would fire when a user clicks on the Edit Dashboard button, thus...