CVE-2016-8748: Improper Neutralization of Input During Web Page Generation

In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM...

UI-Dialog Arbitrary Command Execution Vulnerability

UI-Dialog is a jQuery UI a set of JavaScript libraries in a pop-up box plugin . An arbitrary command execution vulnerability exists in UI-Dialog 1.09 and earlier versions. A remote attacker can exploit this vulnerability to execute arbitrary commands...

Cross site scripting

Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the dialog parameter...

CVE-2017-14588

Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the dialog parameter...

A new kind of Apple phishing scam

In a recent blog post, Felix Krause revealed a method for phishing Apple ID passwords on iOS that would be quite indistinguishable from a real iOS password request. This got us thinking about the ramifications—how else could this tactic be used in the Apple ecosystem, and what kind of damage coul...

iOS Password Prompts are Ripe for Abuse

Apple’s policy to repeatedly ask users for their iTunes password needlessly exposes iOS device owners to possible phishing attacks, according a mobile app developer Felix Krause. Krause’s beef with Apple is that too often and seemingly at random times, popups deliver a dialogue box for users to...

CVE-2017-14588: Improper Neutralization of Input During Web Page Generation

Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the dialog parameter...

PT-2017-13564

Name of the Vulnerable Software and Affected Versions Atlassian Fisheye and Crucible versions prior to 4.4.2 Description The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the dialog parameter. This can be exploited by attacker...

UBUNTU-CVE-2008-7315

UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary commands...

Command injection

UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary commands...

CVE-2008-7315

UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary commands...

DEBIAN-CVE-2008-7315

UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary commands...

CVE-2008-7315

UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary commands...

CVE-2008-7315

UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary commands...

CVE-2008-7315

UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary commands...

CVE-2008-7315

UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary commands...

CVE-2008-7315

UI-Dialog 1.09 and earlier is affected by CVE-2008-7315, and multiple connected sources confirm that it allows remote attackers to execute arbitrary commands. The documents do not provide the underlying root cause details, impacted versions beyond 1.09 and earlier, or any remediation/patch inform...

PT-2017-4723

Name of the Vulnerable Software and Affected Versions: UI-Dialog versions 1.09 and earlier Description: The issue allows remote attackers to execute arbitrary commands. Recommendations: For UI-Dialog versions 1.09 and earlier, at the moment, there is no information about a newer version that...

CVE-2008-7315: Improper Neutralization of Special Elements used in a Command

UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary commands...

UBUNTU-CVE-2017-7815

On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will have an arbitrary domains as the dialog's location, spoofing of the origin of the modal dialog from the user view. Note: This attack only affects installations with e10 multiproce...