CVE-2018-17302

Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /Email/view saved draft message...

CVE-2018-17302: Improper Neutralization of Input During Web Page Generation

Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /Email/view saved draft message...

CVE-2018-16298

MiniCMS 1.10 is affected by a cross-site scripting (XSS) vulnerability in the admin endpoint mc-admin/post.php?tag= where requests with state=delete, state=draft, or state=publish can inject script or HTML. The flaw is triggered via the tag parameter and is present in the public CVE entries acros...

CVE-2018-16278

phpkaiyuancms PhpOpenSourceCMS POSCMS V3.2.0 allows an unauthenticated user to execute arbitrary SQL commands via the diy/module/member/controllers/Api.php ajaxsavedraft function with the dir parameter...

Draft of Microsoft Security Servicing Commitments for Windows

Updated September 10, 2018 The Servicing Criteria for Windows has transitioned to an official document and can be found at the link below. Microsoft thanks the members of the research community who provided feedback on the draft copy. Microsoft Security Servicing Criteria for Windows...

Microsoft Office Information Disclosure Vulnerability (CNVD-2018-00739)

Microsoft Office is an office software suite of products developed by the American Microsoft Corporation Microsoft. An information disclosure vulnerability exists in Microsoft Office that originates from the program failing to properly enforce copy/paste permissions on DRM-protected emails. An...

Vanilla: Overwrite Drafts of Everyone

Description: ----------- Users have option to save drafts before doing comment on posts or discussions, where DraftID parameter is get passed to keep the draft record and if attacker replace this id with any existing id it will simple overwrite that record without checking the permission he that...

Bypass Access Restrictions

Wordpress is vulnerable to bypassing access restrictions. The bypass is possible because the application does not properly check the editposts capability for auto-draft creation actions...

SUSE SLES11 Security Update : MozillaFirefox, mozilla-nss, mozilla-nspr (SUSE-SU-2017:1175-1)

Mozilla Firefox was updated to the Firefox ESR release 45.9. Mozilla NSS was updated to support TLS 1.3 close to release draft and various new ciphers, PRFs, Diffie Hellman key agreement and support for more hashes. Security issues fixed in Firefox bsc1035082 - MFSA 2017-11/CVE-2017-5469: Potenti...

Atlassian Confluence Authentication Bypass Vulnerability

Atlassian Confluence is a professional enterprise knowledge management and collaboration software from Atlassian Australia, which can also be used to build an enterprise WiKi. the software enables collaboration and knowledge sharing between team members. Atlassian Confluence suffers from an...

Draft folder emails in Secure Mail not syncing with MS Exchange

Q: Users create drafts in Secure Mail but these do not get synced with MS Exchange and viewable in Outlook. After repeated attempts to amend and save the draft it will be deleted without being synced. Is this a known issue? A: With regard to the Draft folder syncing, there are limitation regardin...

Russia proposes 10 Year in Prison Sentence for Hackers and Malware Authors

The Russian government has introduced a draft bill that proposes prison sentences as punishment for hackers and cyber criminals creating malicious software used in targeting critical Russian infrastructure, even if they have no part in actual cyber attacks. The bill, published on the Russian...

CVE-2016-4620

The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers to discover text-message recipients via a crafted app...

CVE-2016-4620

The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers to discover text-message recipients via a crafted app...

Design/Logic Flaw

The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers to discover text-message recipients via a crafted app...

CVE-2016-4620

The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers to discover text-message recipients via a crafted app...

CVE-2016-4620: Exposure of Sensitive Information to an Unauthorized Actor

The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers to discover text-message recipients via a crafted app...

Microsoft Office Information Disclosure Vulnerability

An information disclosure vulnerability exists when Microsoft Outlook fails to enforce copy/paste permissions on DRM-protected emails. An attacker who successfully exploited the vulnerability could potentially extract plaintext content from DRM-protected draft emails. The attacker would have to u...

WebUSB API — Connect Your USB Devices Securely to the Internet

Two Google engineers have developed a draft version of an API called WebUSB that would allow you to connect your USB devices to the Web safely and securely, bypassing the need for native drivers. WebUSB – developed by Reilly Grant and Ken Rockot – has been introduced to the World Wide Web...

Shopify: XSS in Draft Orders in Timeline i SHOPIFY Admin Site!

Create an Draft with a product named "img src=x onerror=prompt'XSSP' 2. Send the Draft to someone and complete the order. Order is shown as Completed Drafts as order.png 3. Create a timeline and reference this Draft. As soon as you click POST you will be XSSEd xss.png Thanks...