CVE-2019-14280

In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public...

CVE-2019-14280

In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public...

Code injection

In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public...

CVE-2019-14280

CVE-2019-14280 affects Craft CMS (versions prior to 2.7.10 and 3 prior to 3.2.6). The issue is an information disclosure where EXIF data is not stripped from user-uploaded images when configured to do so, potentially exposing personal/geolocation data. Red Hat and NVD entries reiterate the vulner...

CVE-2019-14280

In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public...

Craft CMS Information Disclosure Vulnerability (CNVD-2019-24876)

Craft CMS is a content management system CMS. An information disclosure vulnerability exists in Craft CMS version 2 prior to 2.7.10 and version 3 prior to 3.2.6. The vulnerability stems from an error in configuration or other errors in the operation of a networked system or product. An unauthoriz...

CVE-2019-14280: Exposure of Sensitive Information to an Unauthorized Actor

In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public...

CVE-2019-12804

In Hunesion i-oneNet version 3.0.7 3.0.53 and 4.0.4 4.0.16, due to the lack of update file integrity checking in the upgrade process, an attacker can craft malicious file and use it as an update...

CVE-2019-12980

In Ming aka libming 0.4.8, there is an integer overflow caused by an out-of-range left shift in the SWFInputreadSBits function in blocks/input.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted swf file...

Craft CMS Cross-Site Scripting Vulnerability (CNVD-2019-18754)

Craft CMS is a content management system CMS. A cross-site scripting vulnerability exists in Craft CMS version 3.1.30. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit the vulnerability to execute client-side code...

CVE-2019-12823

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

CVE-2019-12823

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

Cross site scripting

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

CVE-2019-12823

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

CVE-2019-12823

Craft CMS before 3.1.31 is vulnerable to cross-site scripting due to improper filtering of XML feeds. Affects Craft CMS core XML feed handling; attacker could inject and execute client-side scripts. CVSS metrics indicate MEDIUM severity (CVSS 3.1 base 6.1) with network access, no privileges requi...

CVE-2019-12823: Improper Neutralization of Input During Web Page Generation

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

CVE-2018-13381: Improper Restriction of Operations within the Bounds of a Memory Buffer

A buffer overflow vulnerability in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.7, 5.4 and earlier versions and FortiProxy 2.0.0, 1.2.8 and earlier versions under SSL VPN web portal allows a non-authenticated attacker to perform a Denial-of-service attack via special craft message...

Excerpts from “5 Questions for Eric O’Neil—the FBI “ghost” who brought down a Russian Mole”

Eric O’Neill serves as Carbon Black’s national security strategist where he is a thought leader on a wide range of issues including counterterrorism and national security matters. Prior to this, he was as an operative for the FBI, where he conducted national security field operations against...

Electro-Craft IQ Position Controller IQ DeviceNet Adapter

Binary data 754806.prm...

CVE-2019-11068

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded...