Hitachi Energy XMC20 and FOX61x

1. EXECUTIVE SUMMARY CVSS v3 9.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: XMC20 and FOX61x Vulnerabilities: Weak Password Requirements, Missing Handler 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to...

Cross-site Scripting in python-cjson

Python-cjson 1.0.5 does not properly handle a '/' argument to cjson.encode, which makes it easier for remote attackers to conduct certain cross-site scripting XSS attacks involving Firefox and the end tag of a SCRIPT element...

Matrix clients -- several vulnerabilities

Matrix developers report: Today we are releasing security updates to libolm, matrix-js-sdk, and several clients including Element Web / Desktop. Users are encouraged to upgrade as soon as possible. These releases mitigate a buffer overflow in olmsessiondescribe, a libolm debugging function used b...

S3Scanner allows Directory Traversal

S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a ../ substring in a ListBucketResult element...

Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-90762)

Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited...

CVE-2019-5640

Rapid7 Nexpose versions prior to 6.6.114 suffer from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the inspect element browser feature to remove the login panel and view the details available in the last webpage visited by previous...

Design/Logic Flaw

Rapid7 Nexpose versions prior to 6.6.114 suffer from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the inspect element browser feature to remove the login panel and view the details available in the last webpage visited by previous...

Design/Logic Flaw

OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message...

CVE-2021-38375

OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message...

CVE-2019-5640: Exposure of Sensitive Information to an Unauthorized Actor

Rapid7 Nexpose versions prior to 6.6.114 suffer from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the inspect element browser feature to remove the login panel and view the details available in the last webpage visited by previous...

CVE-2021-38375: Improper Neutralization of Input During Web Page Generation

OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message...

PT-2021-9120 · Rapid7 · Rapid7 Nexpose

Name of the Vulnerable Software and Affected Versions: Rapid7 Nexpose versions prior to 6.6.114 Description: The issue allows an attacker to expose information when a user's session has ended due to inactivity. By using the inspect element browser feature, an attacker can remove the login panel a...

PT-2021-22089

Name of the Vulnerable Software and Affected Versions OX App Suite versions 7.10.5 and earlier Description The issue allows for cross-site scripting XSS attacks via the alt attribute of an IMG element in a truncated e-mail message. Recommendations For OX App Suite versions 7.10.5 and earlier,...

November 22, 2021-KB5007292 Cumulative Update Preview for .NET Framework 3.5 and 4.8 for Windows 11

None None...

ALPINE-CVE-2021-42375

An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input...

element-house.ru Improper Access Control vulnerability OBB-2265283

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-3840

A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index PyPi. MITRE classifies this weakness as...

Type confusion

A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index PyPi. MITRE classifies this weakness as...

CVE-2021-3840

CVE-2021-3840 : A dependency confusion flaw in the Antilles open-source software prior to 1.0.1 could allow remote code execution during installation when a package listed in requirements.txt does not exist in PyPI. The issue is categorized as CWE-427 (Uncontrolled Search Path Element) where a pr...

Cross-Site Scripting (XSS)

dolibarr/dolibarr is vulnerable to cross-site scripting XSS. The vulnerability exists in object details that allow XSS payloads in the onpointermove attribute of a BODY element...