PT-2018-14907

Name of the Vulnerable Software and Affected Versions Valine version 1.3.3 Description An issue in Valine allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file. Recommendations For Valine version 1.3.3, consider disabling the...

JEESNS Cross-Site Scripting Vulnerability

JEESNS is an enterprise-level open source social management system building platform based on Java and MySQL, which includes microblogging module, group module and article module. JEESNS 1.3 version of the com/lxinet/jeesns/core/utils/XssHttpServletRequestWrapper.java file cross-site scripting...

CVE-2018-19178

In JEESNS 1.3, com/lxinet/jeesns/core/utils/XssHttpServletRequestWrapper.java allows stored XSS via an HTML EMBED element, a different vulnerability than CVE-2018-17886...

Cross site scripting

In JEESNS 1.3, com/lxinet/jeesns/core/utils/XssHttpServletRequestWrapper.java allows stored XSS via an HTML EMBED element, a different vulnerability than CVE-2018-17886...

CVE-2018-19178

In JEESNS 1.3, com/lxinet/jeesns/core/utils/XssHttpServletRequestWrapper.java allows stored XSS via an HTML EMBED element, a different vulnerability than CVE-2018-17886...

CVE-2018-19178

In JEESNS 1.3, com/lxinet/jeesns/core/utils/XssHttpServletRequestWrapper.java allows stored XSS via an HTML EMBED element, a different vulnerability than CVE-2018-17886...

CVE-2018-19178

CVE-2018-19178 concerns JEESNS 1.3. The vulnerability is in com/lxinet/jeesns/core/utils/XssHttpServletRequestWrapper.java and allows stored XSS via an HTML EMBED element. This CVE entry notes it is a different issue from CVE-2018-17886. The available sources describe the affected component and t...

CVE-2018-19178

In JEESNS 1.3, com/lxinet/jeesns/core/utils/XssHttpServletRequestWrapper.java allows stored XSS via an HTML EMBED element, a different vulnerability than CVE-2018-17886...

CVE-2018-19178: Improper Neutralization of Input During Web Page Generation

In JEESNS 1.3, com/lxinet/jeesns/core/utils/XssHttpServletRequestWrapper.java allows stored XSS via an HTML EMBED element, a different vulnerability than CVE-2018-17886...

PT-2018-14840

Name of the Vulnerable Software and Affected Versions JEESNS version 1.3 Description The issue in JEESNS allows stored XSS via an HTML EMBED element. This is a different issue than previously identified vulnerabilities. Recommendations For JEESNS version 1.3, consider disabling the...

com.brienwheeler.apps:apps-tomcat (>=1.10, <=1.11), com.brienwheeler.dist:dist-tomcat (>=1.10, <=1.11) +19 more potentially affected by CVE-2018-8037 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m9, <=9.0.8)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m9, =1.10, =1.10, =9.0.8.0, =9.0.8.0, =9.0.8.0, =9.0.8.0, =9.0.8.0, =0.60.0, =0.60.0, =1.6-beta.2, =5.0.5, =1.2, =9.0.0.m9, =9.0.0.m9, =9.0.8 and more Source cves: CVE-2018-8037 Source advisory: GHSA-6V52-MJ5R-7J2M...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), am.ik.servicebroker:cloud-karafka-service-broker (>=0.0.2, <=0.0.3) +2934 more potentially affected by CVE-2018-8037 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.5, <=8.5.31)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.5, =1.0.0, =0.0.2, =0.0.3, =0.0.1, =0.2.0, =1.0.3, =0.2.1, =0.1.1, =0.1.1, =0.7, =0.8 and more Source cves: CVE-2018-8037 Source advisory: GHSA-6V52-MJ5R-7J2M...

com.brienwheeler.apps:apps-tomcat (>=1.10, <=1.11), com.brienwheeler.dist:dist-tomcat (>=1.10, <=1.11) +19 more potentially affected by CVE-2018-8037 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m9, <=9.0.8)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m9, =1.10, =1.10, =9.0.8.0, =9.0.8.0, =9.0.8.0, =9.0.8.0, =9.0.8.0, =0.60.0, =0.60.0, =1.6-beta.2, =5.0.5, =1.2, =9.0.0.m9, =9.0.0.m9, =9.0.8 and more Source cves: CVE-2018-8037 Source advisory: OSV:GHSA-6V52-MJ5R-7J2M...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), am.ik.servicebroker:cloud-karafka-service-broker (>=0.0.2, <=0.0.3) +2934 more potentially affected by CVE-2018-8037 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.5, <=8.5.31)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.5, =1.0.0, =0.0.2, =0.0.3, =0.0.1, =0.2.0, =1.0.3, =0.2.1, =0.1.1, =0.1.1, =0.7, =0.8 and more Source cves: CVE-2018-8037 Source advisory: OSV:GHSA-6V52-MJ5R-7J2M...

Linux kernel information disclosure vulnerability (CNVD-2018-24478)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the 'pcpuembedfirstchunk' function in the mm/percpu.c file in Linux kernel versions 4.14.14 and earlier. A local attacker can exploi...

com.brienwheeler.apps:apps-tomcat (>=1.10, <=1.11), com.brienwheeler.dist:dist-tomcat (>=1.10, <=1.11) +19 more potentially affected by CVE-2018-8037 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m9, <=9.0.8)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m9, =1.10, =1.10, =9.0.8.0, =9.0.8.0, =9.0.8.0, =9.0.8.0, =9.0.8.0, =0.60.0, =0.60.0, =1.6-beta.2, =5.0.5, =1.2, =9.0.0.m9, =9.0.0.m9, =9.0.8 and more Source cves: CVE-2018-8037 Source advisory: MEND:CVE-2018-8037...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), am.ik.servicebroker:cloud-karafka-service-broker (>=0.0.2, <=0.0.3) +2934 more potentially affected by CVE-2018-8037 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.5, <=8.5.31)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.5, =1.0.0, =0.0.2, =0.0.3, =0.0.1, =0.2.0, =1.0.3, =0.2.1, =0.1.1, =0.1.1, =0.7, =0.8 and more Source cves: CVE-2018-8037 Source advisory: MEND:CVE-2018-8037...

chromium-browser: Incorrect handling of plug-ins by Service Worker

Service Workers can intercept any request made by an or tag in Fetch API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

PT-2017-3823

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 4.14.14 Description The issue is related to the pcpu embed first chunk function in the Linux kernel, which allows local users to obtain sensitive address information by reading dmesg data from a "pages/cpu" printk...

Khan Academy: Frameset(Frame) html tag is allowed in html editor.(can lead to clickjacking)

Hello Sir/Mam , I was using the html editor in computer programming section , which allowed me to design a webpage. When i use the iframe tag , object tag and embed tag it show me the message that these tags are not allowed for security reasonsmay be cause of clickjacking attack or something but...