CVE-2020-15183: Improper Neutralization of Input During Web Page Generation

SoyCMS 3.0.2 and earlier is affected by Reflected Cross-Site Scripting XSS which leads to Remote Code Execution RCE from a known vulnerability. This allows remote attackers to force the administrator to edit files once the adminsitrator loads a specially crafted webpage...

CVE-2020-15182: Improper Limitation of a Pathname to a Restricted Directory

The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery CSRF and Remote Code Execution RCE. The vulnerability affects versions 2.0.0.3 and earlier of SOY Inquiry. This allows remote attackers to force the administrator to edit files once the administrator loads a specially...

Authorization

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to the lack of authorization control...

Cross-Site Scripting in diagram-js-direct-editing

Versions of diagram-js-direct-editing prior to 1.4.3 are vulnerable to Cross-Site Scripting. The package fails to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.4.3 or later...

GHSA-J8R2-2X94-2Q67 Cross-Site Scripting in diagram-js-direct-editing

Versions of diagram-js-direct-editing prior to 1.4.3 are vulnerable to Cross-Site Scripting. The package fails to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.4.3 or later...

PT-2020-21367

Name of the Vulnerable Software and Affected Versions diagram-js-direct-editing versions prior to 1.4.3 Description The issue arises from the package's failure to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser, thus facilitating...

PT-2020-14243

Name of the Vulnerable Software and Affected Versions apollo-adminservice versions prior to 1.7.1 Description The issue arises when apollo-adminservice is exposed to the internet, which is not recommended, as it is designed to work in an intranet and lacks built-in access controls. This could all...

CVE-2020-6312

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit certain web page properties, can modify how a browser processes particular page elements, leading to stored Cross Site...

Automattic: IDOR leads to Edit Anyone's Blogs / Websites

Hello there, I hope all is well! Steps: 1. Go to https://intensedebate.com/signup and create 2 accounts. 2. Login as victim and go to https://www.intensedebate.com/edit-user-profile 3. Click Add Blog / Website text and fill the form click Save Settings button 4. Go to...

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are related to the issue of operations occurring outside the buffer in memory. This allows attackers to gain unauthorized access to protected information.

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat and Document Cloud, are related to the execution of operations beyond the buffer boundaries in memory. Exploiting these vulnerabilities can allow unauthorized...

Fedora: Security Advisory for eclipse-mylyn (FEDORA-2020-cf8ef2f333)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for eclipse-gef (FEDORA-2020-cf8ef2f333)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 32 Update: eclipse-gef-3.11.0-13.fc32

The Graphical Editing Framework GEF allows developers to create a rich graphical editor from an existing application model. GEF is completely application neutral and provides the groundwork to build almost any application, including but not limited to: activity diagrams, GUI builders, class diagr...

[SECURITY] Fedora 32 Update: eclipse-mylyn-3.25.0-3.fc32

Mylyn integrates task support into Eclipse. It supports offline editing for certain task repositories and monitors work activity to hide information that is not relevant to the current task...

CVE-2020-19885

DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for '$POST'pageparaminsertname'' variable in dbhcms\mod\mod.page.edit.php line 227, A remote authenticated with admin user can exploit this vulnerability to hijack other users...

Cross site scripting

DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for '$POST'pageparaminsertname'' variable in dbhcms\mod\mod.page.edit.php line 227, A remote authenticated with admin user can exploit this vulnerability to hijack other users...

Logic Flaw Vulnerability in the Manuscript Management Platform of Sancai Journal Acquisition and Editing System

Sancai Journal Acquisition and Editing System is a preferred networked office platform for scientific and technical journals. A logic flaw vulnerability exists in the manuscript management platform of Sancai Journal Acquisition and Editing System, which can be exploited by attackers to obtain...

CVE-2020-1567

A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input. An attacker could execute arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the...

CVE-2020-1567: Undefined Security Weakness

A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input. An attacker could execute arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the...

Friday Squid Blogging: Editing the Squid Genome

Scientists have edited the genome of the Doryteuthis pealeii squid with CRISPR. A first. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...