CVE-2019-14280

In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public...

CVE-2019-14280

In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public...

Code injection

In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public...

CVE-2019-14280

In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public...

CVE-2019-14280

CVE-2019-14280 affects Craft CMS (versions prior to 2.7.10 and 3 prior to 3.2.6). The issue is an information disclosure where EXIF data is not stripped from user-uploaded images when configured to do so, potentially exposing personal/geolocation data. Red Hat and NVD entries reiterate the vulner...

Craft CMS Information Disclosure Vulnerability (CNVD-2019-24876)

Craft CMS is a content management system CMS. An information disclosure vulnerability exists in Craft CMS version 2 prior to 2.7.10 and version 3 prior to 3.2.6. The vulnerability stems from an error in configuration or other errors in the operation of a networked system or product. An unauthoriz...

CVE-2019-12804

In Hunesion i-oneNet version 3.0.7 3.0.53 and 4.0.4 4.0.16, due to the lack of update file integrity checking in the upgrade process, an attacker can craft malicious file and use it as an update...

CVE-2019-12980

In Ming aka libming 0.4.8, there is an integer overflow caused by an out-of-range left shift in the SWFInputreadSBits function in blocks/input.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted swf file...

Craft CMS Cross-Site Scripting Vulnerability (CNVD-2019-18754)

Craft CMS is a content management system CMS. A cross-site scripting vulnerability exists in Craft CMS version 3.1.30. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit the vulnerability to execute client-side code...

CVE-2019-12823

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

CVE-2019-12823

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

Cross site scripting

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

CVE-2019-12823

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

CVE-2019-12823

Craft CMS before 3.1.31 is vulnerable to cross-site scripting due to improper filtering of XML feeds. Affects Craft CMS core XML feed handling; attacker could inject and execute client-side scripts. CVSS metrics indicate MEDIUM severity (CVSS 3.1 base 6.1) with network access, no privileges requi...

Excerpts from “5 Questions for Eric O’Neil—the FBI “ghost” who brought down a Russian Mole”

Eric O’Neill serves as Carbon Black’s national security strategist where he is a thought leader on a wide range of issues including counterterrorism and national security matters. Prior to this, he was as an operative for the FBI, where he conducted national security field operations against...

Electro-Craft IQ Position Controller IQ DeviceNet Adapter

Binary data 754806.prm...

CVE-2019-11068

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded...

Apache Axis 1.4 Remote Code Execution

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Apache Axis 1.4 Remote Code Execution CVE-2019-0227 https://rhinosecuritylabs.com/Application-Security/CVE-2019-0227-Expired-Domain-to-RCE-in-Apache-Axis Author: David Yesland @daveysec, Rhino...

CVE-2019-9718

In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ffhtmlmarkuptoass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf...

Craft CMS Cross-Site Scripting Vulnerability (CNVD-2019-06339)

Craft CMS is a content management system CMS. A cross-site scripting vulnerability exists in the header insertion field in Craft CMS version 3.1.12 Pro. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...