176 matches found
CVE-2020-28859
OpenAsset Digital Asset Management DAM through 12.0.19 does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting attacks...
CVE-2020-28858
OpenAsset Digital Asset Management (DAM) is affected by CSRF (CVE-2020-28858). vulnerable: Cloud 12.0.19 and On‑premise 11.2.1; fixed: Cloud 12.0.26 and On‑premise 11.4.10. Root cause: the app did not verify that user actions were intentionally initiated by the user, enabling CSRF across user fun...
CVE-2020-28857
OpenAsset Digital Asset Management (DAM) prior to patches 12.0.23 (Cloud) / 11.4.10 (On‑prem) is vulnerable to stored cross‑site scripting due to incomplete sanitization of user input across multiple parameters and endpoints (e.g., system preferences, project code, user/password regex fields, and...
CVE-2020-28857
OpenAsset Digital Asset Management DAM through 12.0.19, does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for stored cross-site scripting attacks...
CVE-2020-28856
OpenAsset Digital Asset Management DAM through 12.0.19 does not correctly determine the HTTP request's originating IP address, allowing attackers to spoof it using X-Forwarded-For in the header, by supplying localhost address such as 127.0.0.1, effectively bypassing all IP address based access...
Design/Logic Flaw
OpenAsset Digital Asset Management DAM through 12.0.19 does not correctly determine the HTTP request's originating IP address, allowing attackers to spoof it using X-Forwarded-For in the header, by supplying localhost address such as 127.0.0.1, effectively bypassing all IP address based access...
CVE-2020-28856
Summary (CVE-2020-28856) OpenAsset Digital Asset Management (DAM) prior to 12.0.20 (Cloud) / 11.4.10 (On‑premise) improperly determines the originating IP from HTTP requests, enabling spoofing via the X-Forwarded-For header (e.g., 127.0.0.1) and bypassing IP‑based access controls. Affected versio...
damsafety.in Cross Site Scripting vulnerability OBB-1416538
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Key Findings from the 2020 Cyberthreat Defense Report
The new 2020 Cyberthreat Defense Report CDR released this week. Now in its seventh year, the annual report provides a look at how global cybersecurity professionals perceive threats and plan to defend against them. The CDR enables cybersecurity professionals to benchmark their company’s security...
Phraseanet DAM Cross Site Scripting
Exploit title: Stored XSS vulnerability in Phraseanet DAM Open Source software Date: 10/10/2018 Exploit Author: Krzysztof Szulski Vendor Homepage: https://www.phraseanet.com Software Link also VM: https://www.phraseanet.com/en/download/ Version affected: 4.0.3 4.0.4-dev and below Version fixed:...
CVE-2018-2440
CVE-2018-2440 affects SAP Dynamic Authorization Management (DAM) via NextLabs’ Java Policy Controller versions 7.7 and 8.5. The vulnerability description states that, under certain circumstances, sensitive information is exposed in application logs. This creates potential information disclosure, ...
CVE-2018-4875
Adobe Experience Manager versions 6.1 and 6.0 are vulnerable to a reflected cross-site scripting vulnerability related to the handling of malicious content embedded in image files uploaded to the DAM...
CVE-2018-4875
Adobe Experience Manager versions 6.1 and 6.0 are vulnerable to a reflected cross-site scripting vulnerability related to the handling of malicious content embedded in image files uploaded to the DAM...
CVE-2018-4875
Adobe Experience Manager 6.0 and 6.1 are affected by a reflected cross-site scripting vulnerability (CVE-2018-4875) tied to handling of malicious content embedded in images uploaded to the DAM. The issue arises from how image files are processed, enabling a reflected XSS vector. Affected products...
A Deep Dive into Database Attacks [Part I]: SQL Obfuscation
Today, data breaches are a threat to every organization. According to a report from Risk Based Security covering the first half of 2017, over 6 billion records were exposed through 2,227 publicly-disclosed data breaches. The number of exposed records is already higher than the previous all-time...
Database Activity Monitoring: A Do’s and Don’ts Checklist for DBAs
In a previous post, we looked at the limitations of native audit, the free tool often used by database administrators DBAs for logging database activity. While it has its appeal—it’s already part of the database server and does not require additional cost for third-party appliances or...
Threat Outbreak Alert RuleID28316: Email Messages Distributing Malicious Software on March 15, 2017
Medium Alert ID: 53040 First Published: 2017 March 15 17:52 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28316 may contain the following files: Name | Si...
CVE-2016-7884
Adobe Experience Manager versions 6.1 and earlier have an input validation issue in the DAM create assets that could be used in cross-site scripting attacks...
CVE-2016-7884
Adobe Experience Manager (AEM) versions 6.1 and earlier are affected by an input validation issue in the DAM create assets flow that could enable cross-site scripting. The problem is described in the CVE entry as an input validation flaw leading to XSS. The connected documents confirm the affecte...
The 7 Most Wanted Iranian Hackers By the FBI
The Federal Bureau of Investigation FBI has lengthened its Most Wanted List by adding seven Iranian hackers who are accused of attacking a range of US banks and a New York dam. On Thursday, the United States Department of Justice DoJ charged seven Iranian hackers with a slew of computer hacking...