4232 matches found
CVE-2019-11547: Improper Neutralization of Input During Web Page Generation
An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has Improper Encoding or Escaping of Output. The branch name on new merge request notification emails isn't escaped, which could potentially lead to XSS issues...
CVE-2019-11544: Undefined Security Weakness
An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It allows Information Disclosure. Non-member users who subscribe to notifications of an internal project with issue and repository...
PT-2019-12370
Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.8.x through 11.8.8 GitLab Community and Enterprise Edition versions 11.9.x through 11.9.9 GitLab Community and Enterprise Edition versions 11.10.x through 11.10.1 Description The issue is...
Potential Hurricane Dorian Cyber Scams
The Cybersecurity and Infrastructure Security Agency CISA warns users to remain vigilant for malicious cyber activity targeting Hurricane Dorian disaster victims and potential donors. Fraudulent emails commonly appear after major natural disasters and often contain links or attachments that direc...
XKCD Forum Hacked – Over 562,000 Users' Account Details Leaked
XKCD —one of the most popular webcomic platforms known for its geeky tech humor and other science-laden comic strips on romance, sarcasm, math, and language—has suffered a data breach exposing data of its forum users. The security breach occurred two months ago, according to security researcher...
Imperva Breach Exposes WAF Customers' Data, Including SSL Certs, API Keys
Imperva, one of the leading cybersecurity startups that helps businesses protect critical data and applications from cyberattacks, has suffered a data breach that has exposed sensitive information for some of its customers, the company revealed today. The security breach particularly affects...
Hostinger Suffers Data Breach – Resets Password For 14 Million Users
Popular web hosting provider Hostinger has been hit by a massive data breach, as a result of which the company has reset passwords for all customers as a precautionary measure. In a blog post published on Sunday, Hostinger revealed that "an unauthorized third party" breached one of its servers an...
Russian Hacking Group Targeting Banks Worldwide With Evolving Tactics
Silence APT, a Russian-speaking cybercriminal group, known for targeting financial organizations primarily in former Soviet states and neighboring countries is now aggressively targeting banks in more than 30 countries across America, Europe, Africa, and Asia. Active since at least September 2016...
Microsoft Outlook Elevation of Privilege Vulnerability (CNVD-2019-40535)
Microsoft Outlook is a personal information management system software with features such as sending and receiving e-mail, calendars and more. An elevation of privilege vulnerability exists in Microsoft Outlook, which arises from a failure to adequately validate the format of incoming emails as...
The vulnerability of Firefox ESR, Firefox, and the email client Thunderbird exists due to insufficient checking of parameters in messages from the child process to the parent process. This allows a malicious actor to execute arbitrary code.
The vulnerability of Firefox ESR, Firefox, and the email client Thunderbird exists due to insufficient checking of parameters in messages from the child process to the parent process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the target system by causing...
PT-2019-2996 · Microsoft · Outlook Ios
Name of the Vulnerable Software and Affected Versions: Microsoft Outlook iOS affected versions not specified Description: The issue exists due to insufficient input validation in the Microsoft Outlook iOS software. This allows a remote attacker to perform cross-site scripting attacks, potentially...
UNA 10.0.0 RC1 - (polyglot.php) Persistent Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: UNA - 10.0.0-RC1 stored XSS vuln. Exploit Author: Greg.Priest Vendor Homepage: https://una.io/ Software Link: https://github.com/unaio/una/tree/master/studio Version: UNA - 10.0.0-RC1 Tested on: Windows/Linux CVE : CVE-2019-1480...
UNA 10.0.0 RC1 - 'polyglot.php' Persistent Cross-Site Scripting
Exploit Title: UNA - 10.0.0-RC1 stored XSS vuln. Date: 2019 08 10 Exploit Author: Greg.Priest Vendor Homepage: https://una.io/ Software Link: https://github.com/unaio/una/tree/master/studio Version: UNA - 10.0.0-RC1 Tested on: Windows/Linux CVE : CVE-2019-14804 UNA-v.10.0.0-RC1 Stored XSS...
CVE-2019-14804
studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing...
CVE-2019-14804: Improper Neutralization of Input During Web Page Generation
studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing...
DEBIAN-CVE-2019-14664
In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended...
CVE-2019-14664
In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended...
CVE-2019-14664
The CVE affects Enigmail before 2.1. An attacker with access to PGP-encrypted emails can wrap the ciphertext into sub-parts of a crafted multipart message. The attacker may hide encrypted parts using HTML/CSS or ASCII newlines and resubmit the message; when the recipient replies, plaintext of the...
Nation-State APTs Target U.S. Utilities With Dangerous Malware
Researchers believe that nation-state actors are behind several spearphishing campaigns targeting U.S. utility companies with a newly-identified malware, which has the capabilities to view system data and reboot machines. Lure emails were sent to three U.S. utilities companies between July 19 and...
