Shopify: Stored XSS in /admin/orders

Hi , I have found a Stored XSS vulnerability in orders page. Steps to reproduce: 1. Create a new order with an item that requires shipping 2. Go to https://.myshopify.com/admin/orders/ 3. Click the Fulfill items button then fulfill the items 4. Now a new fulfillment with an id will be generated ,...

CVE-2015-5854

The backup implementation in Time Machine in Apple OS X before 10.11 allows local users to obtain access to keychain items via unspecified vectors...

Information disclosure

The backup implementation in Time Machine in Apple OS X before 10.11 allows local users to obtain access to keychain items via unspecified vectors...

CVE-2015-5854

The backup implementation in Time Machine in Apple OS X before 10.11 allows local users to obtain access to keychain items via unspecified vectors...

Oracle: Security Advisory (ELSA-2013-0131)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

subversion: svn_repos_trace_node_locations() reveals paths hidden by authz

It was found that when an SVN server both svnserve and httpd with the moddavsvn module searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable for example, if it had been moved...

Using V8 U-AIR wizards to restore Exchange 2003 and 2007

This KB article documents the procedure for restoring Application Items for Exchange 2003 and Exchange 2007. The Veeam Explorer for Microsoft Exchange does not support these versions of Exchange. In o...

zillow.com XSS vulnerability

Vulnerable URL: http://www.zillow.com/agent-finder/real-estate-agent-reviews/?sortBy=None=False=alert/XSSPOSED/...

CVE-2015-0313

creationtimestamp| type| source ---|---|--- 2015-03-31 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36579 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobeflashworkerbytearrayuaf.rb 2020-10-09...

CVE-2014-8831

securitytaskgate in Apple OS X before 10.10.2 allows attackers to read group-ACL-restricted keychain items of arbitrary apps via a crafted app with a signature from a 1 self-signed certificate or 2 Developer ID certificate...

Code injection

securitytaskgate in Apple OS X before 10.10.2 allows attackers to read group-ACL-restricted keychain items of arbitrary apps via a crafted app with a signature from a 1 self-signed certificate or 2 Developer ID certificate...

CVE-2014-8831

securitytaskgate in Apple OS X before 10.10.2 allows attackers to read group-ACL-restricted keychain items of arbitrary apps via a crafted app with a signature from a 1 self-signed certificate or 2 Developer ID certificate...

[SECURITY] Fedora 21 Update: xdg-utils-1.1.0-0.35.rc3.fc21

The xdg-utils package is a set of simple scripts that provide basic desktop integration functions for any Free Desktop, such as Linux. They are intended to provide a set of defacto standards. This means that: Third party software developers can rely on these xdg-utils for all of their simple...

CVE-2012-5500

The batch id change script renameObjectsByPaths.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request...

Cross site request forgery (csrf)

The batch id change script renameObjectsByPaths.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request...

PYSEC-2014-42

The batch id change script renameObjectsByPaths.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request...

CVE-2012-5500

The batch id change script renameObjectsByPaths.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request...

CVE-2014-7364

The Promotional Items aka com.wPromotionalItems application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7364

The Promotional Items aka com.wPromotionalItems application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7364

CVE-2014-7364 concerns the Android app “Promotional Items” (com.wPromotionalItems) version 0.1. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. ...