CVE-2018-1000802

Python Software Foundation Python CPython version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in shutil module makearchive function that can result in Denial of service, Information gain via injection of arbitrary files on...

CVE-2018-1000802

Python Software Foundation Python CPython version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in shutil module makearchive function that can result in Denial of service, Information gain via injection of arbitrary files on...

turkishculturalfoundation.org XSS vulnerability

Open Bug Bounty ID: OBB-674948 Description| Value ---|--- Affected Website:| turkishculturalfoundation.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

mozilla -- multiple vulnerabilities

Mozilla Foundation reports: CVE-2018-12377: Use-after-free in refresh driver timers CVE-2018-12378: Use-after-free in IndexedDB CVE-2018-12379: Out-of-bounds write with malicious MAR file CVE-2017-16541: Proxy bypass using automount and autofs CVE-2018-12381: Dragging and dropping Outlook email...

I'm Doing a Reddit AMA

On Thursday, September 6, starting at 10:00 am CDT, I'll be doing a Reddit "Ask Me Anything" in association with the Ford Foundation. It's about my new book, but -- of course -- you can ask me anything. No promises that I will answer everything...

August 30, 2018—KB4346783 (OS Build 17134.254)

None None...

Yahoo Persists in Scanning Emails for In-Depth Ad-Targeting

While the rest of the U.S. tech industry is taking steps to assuage consumer concerns over privacy and data-harvesting, Yahoo is selling off the ability to scan more than 200 million Yahoo Mail inboxes for rich user data that might be used for marketing purposes. Verizon’s Oath unit, which owns...

Dojo Toolkit 1.13 Cross Site Scripting Vulnerability

Exploit for jsp platform in category web applications Product: Dojo Toolkit Manufacturer: JS Foundation Affected Versions: 1.13 Tested Versions: 1.13, 1.10.7 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2018-07-02 Solution...

Dojo Toolkit 1.13 Cross Site Scripting

Advisory ID: SYSS-2018-010 Product: Dojo Toolkit Manufacturer: JS Foundation Affected Versions: 1.13 Tested Versions: 1.13, 1.10.7 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2018-07-02 Solution Date: 2018-10-13 Public...

Apache Releases Security Update for Apache Struts 2

The Apache Software Foundation has released a security update to address a vulnerability in Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16. A remote attacker could exploit this vulnerability to take control of an affected system. NCCIC encourages users and administrators to review Apache...

Security Bulletin: Multiple vulnerabilities may affect Oracle Outside In Technology (OIT) Version 8.5.3 used by IBM FileNet Content Manager and IBM Content Foundation

Summary Security Bulletin: Multiple vulnerabilities may affect Oracle Outside In Technology OIT Version 8.5.3 used by IBM FileNet Content Manager and IBM Content Foundation. Oracle OIT issues disclosed in the Oracle April 2018 Critical Patch Update. Vulnerability Details Advisory CVEs: CVEID:...

Security Bulletin: IBM FileNet Content Manager and IBM Content Foundation are affected by multiple vulnerabilities in the Administration Console for Content Platform Engine (ACCE)

Summary The IBM FileNet Content Manager and IBM Content Foundation component "Administration Console for Content Platform Engine" ACCE, is affected by multiple security vulnerabilities. Vulnerability Details Advisory CVEs: CVEID: CVE-2018-1542 DESCRIPTION: The Administration Console for Content...

afristarfoundation.org XSS vulnerability

Open Bug Bounty ID: OBB-664054 Description| Value ---|--- Affected Website:| afristarfoundation.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

The vulnerability of the Preferences component of the Oracle CRM Technical Foundation system, which allows a malicious actor to gain unauthorized access to protected data

The vulnerability of the Preferences component of the Oracle CRM Technical Foundation system relates to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data using the HTTP protocol...

Cross site scripting

IBM Jazz Foundation products IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2018-1422

IBM Jazz Foundation products IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2018-1422

IBM Jazz Foundation products IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2018-1422

CVE-2018-1422 affects IBM Jazz Foundation-based products, notably IBM Rational DOORS Next Generation (DNG/RRC) versions 5.0–5.0.2 and 6.0–6.0.5. The issue is a cross-site scripting vulnerability that lets an attacker embed arbitrary JavaScript in the Web UI, potentially leading to credentials dis...

CVE-2018-1422

IBM Jazz Foundation products IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2018-14773

An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a legacy IIS header that lets users override the path in the request URL via the...