CVE-2018-1000611

SURFnet OpenConext EngineBlock version 5.7.0 to 5.7.3 contains a Cross Site Scripting XSS vulnerability that can result in Allows an attacker to inject arbitrary web scripts or HTML into help and login pages. This attack appear to be exploitable via the victim opening a specially crafted URL...

CVE-2018-1000611: Improper Neutralization of Input During Web Page Generation

SURFnet OpenConext EngineBlock version 5.7.0 to 5.7.3 contains a Cross Site Scripting XSS vulnerability that can result in Allows an attacker to inject arbitrary web scripts or HTML into help and login pages. This attack appear to be exploitable via the victim opening a specially crafted URL...

Open Redirect

ASP.NET Core and Microsoft.NETCore.App are vulnerable to an open redirect vulnerability. An attacker would be able to craft a URL which would redirect victims to a malicious web page when the URL is visited...

EMS Master Calendar Cross-Site Scripting Vulnerability

EMS Master Calendar is a schedule management system from EMS Software, USA. The system provides instant access to dates and locations. A cross-site scripting vulnerability exists in versions prior to EMS Master Calendar 8.0.0.201805210, where the program fails to properly filter user-submitted...

Mozilla Firefox Cross-Site Scripting Vulnerability (CNVD-2018-12399)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A cross-site scripting vulnerability exists in Mozilla Firefox versions prior to 59, where the program fails to properly validate user-submitted input. The vulnerability can be exploited by a...

Updated xdg-utils package fixes security vulnerability

Updated xdg-utils package fixes security vulnerability: The openenvvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via ...

CVE-2018-11647

index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL...

Design/Logic Flaw

index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL...

CVE-2018-11647

index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL...

CVE-2018-11647

index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL...

CVE-2018-11647

index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL...

CVE-2018-11647: Improper Neutralization of Input During Web Page Generation

index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL...

PT-2018-10729

Name of the Vulnerable Software and Affected Versions oauth2orize-fprm versions prior to 0.2.1 Description The issue is related to a crafted URL that can cause XSS. Recommendations For versions prior to 0.2.1, update to version 0.2.1 or later to resolve the issue...

Security Bulletin: HTTP Response Splitting vulnerability affects IBM Security Guardium (CVE-2017-1262 )

Summary A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks. IBM Security Guardium has provided a fix for this vulnerability. Vulnerability...

Security Bulletin: Path Traversal affects IBM Security Guardium Database Activity Monitor (CVE-2016-0298)

Summary IBM Security Guardium Database Activity Monitor could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to view arbitrary files on the system. Vulnerability Details CVEID: CVE-2016-0298 DESCRIPTION: IBM Security Guardium...

Security Bulletin: A security vulnerability has been identified in InfoSphere Data Architect (IDA) that allows remote attackers to inject arbitrary web script or HTML via a crafted URL. (CVE-2015-7439)

Summary A Cross-site scripting XSS vulnerability has been identified in InfoSphere Data Architect IDA, as distributed in IBM Rational Software Architect 8.5 through 9.5, Rational Software Architect for WebSphere Software RSA4WS 8.5 through 9.5, and Rational Software Architect RealTime RSART 8.5...

Balbooa Gridbox Extension Cross-Site Scripting Vulnerability in Joomla!

Joomla! is an American Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds, site search and other features . Balbooa Gridbox extension is used in which a drag-and-drop site building extension . A cross-site scripting vulnerability...

CVE-2018-11690

The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the...

Updated scummvm packages fix security vulnerability

Updated scummvm package fixes security vulnerability ScummVM 1.8.1's POSIX backend does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL CVE-2017-17528. This...

PT-2018-10752

Name of the Vulnerable Software and Affected Versions Balbooa Gridbox extension versions prior to 2.4.0 Description The issue is caused by improper validation of user-supplied input, leading to cross-site scripting. A remote attacker could exploit this via a crafted URL to execute script in a...