About the security content of watchOS 5.1.3

About the security content of watchOS 5.1.3 This document describes the security content of watchOS 5.1.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

About the security content of tvOS 12.1.2

About the security content of tvOS 12.1.2 This document describes the security content of tvOS 12.1.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

About the security content of macOS Mojave 10.14.3, Security Update 2019-001 High Sierra, Security Update 2019-001 Sierra

About the security content of macOS Mojave 10.14.3, Security Update 2019-001 High Sierra, Security Update 2019-001 Sierra This document describes the security content of macOS Mojave 10.14.3, Security Update 2019-001 High Sierra, Security Update 2019-001 Sierra. About Apple security updates For o...

CVE-2018-7011

CVE-2018-7011 entry is rejected/not used and does not represent an active vulnerability.

Suspicious JavaScript Obfuscation Chunks Technique

Known exploits could potentially bypass security products by using JavaScript obfuscation techniques. Obfuscated exploits might not be detected by IDS and IPS systems, thus allowing attackers to successfully attack the target web client...

Fork CMS Cross-Site Scripting Vulnerability (CNVD-2019-01096)

Fork CMS is an open source content management system CMS developed using PHP. The system contains blogs , questions and answers , forms and other modules . A cross-site scripting vulnerability exists in the private/en/settings page in Fork CMS version 5.0.6. A remote attacker can exploit this...

CVE-2018-1000420

An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins...

Design/Logic Flaw

Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebookadminids parameter aka "Admin ids" input in the Facebook section...

Authorization

An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins...

CVE-2018-20682

Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebookadminids parameter aka "Admin ids" input in the Facebook section...

CVE-2018-20682

Fork CMS 5.0.6 is affected by a stored XSS in the private/en/settings facebook_admin_ids input (Admin ids). The root cause is unsanitized/unencoded input rendered to users, enabling arbitrary script execution in stored form. Exploitation status is not detailed in the provided documents. Multiple ...

Fedora 28 : php-pear-CAS (2018-0bc91454ce)

Version 1.3.6 Security Fixes: - Fix XSS in proxy mode 271 Joachim Fritschi Bug Fixes: - Fix bad condition 252 Brice Vercoustre - Hash ticket strings to generate valid-length session-ids 224, 244, 248 Adam Franco - Fix 'phpCAS' class capitalization in code 273, 277 phy25 Improvement: - Remove...

SUSE SLES15 Security Update : slurm (SUSE-SU-2018:1925-1)

This update for slurm to version 17.11.7 fixes the following issues: This security issue was fixed : - CVE-2018-10995: Ensure correct handling of user names and group ids bsc1095508. The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security...

Information disclosure

NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=&GOTO8 URIs...

CVE-2018-11741

NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=&GOTO8 URIs...

CVE-2018-11741

NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=&GOTO8 URIs...

CVE-2018-11741

CVE-2018-11741 affects NEC Univerge Sv9100 WebPro 6.00.00. The vulnerability is predictable session IDs that can disclose account information via Home.htm?sessionId=#####&GOTO(8). Affected component is the WebPro web interface; root cause is predictable session identifiers. Impact per documents i...

UBUNTU-CVE-2018-16883

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "alloweduids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers...

CVE-2018-14623

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is...

Sql injection

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is...