8292 matches found
PT-2018-18909
Name of the Vulnerable Software and Affected Versions Joom Sky JS Jobs extension versions prior to 1.2.1 Description The issue is related to a XSS problem. Recommendations For versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue...
CVE-2018-9173: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows remote attackers to inject arbitrary web script or HTML, as demonstrated by the movieName parameter...
JS Jobs,1.2.0,XSS (Cross Site Scripting)
JS Jobs from Joomsky.com, versions 1.2.0 and previous,XSS Cross Site Scripting resolution: update to 1.2.1 update notice: http://www.joomsky.com/products/js-jobs.html...
An in-depth malware analysis of QuantLoader
This guest post is written by Vishal Thakur, CSIRT/Salesforce. For more on Vishal, read his bio at the end of the blog. QuantLoader is a Trojan downloader that has been available for sale on underground forums for quite some time now. It has been used in campaigns serving a range of malware,...
CVE-2017-15719
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor...
CVE-2017-15719
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor...
Design/Logic Flaw
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor...
CVE-2017-15719
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor...
CVE-2017-15719
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor...
CVE-2017-15719
CVE-2017-15719 describes a Cross-Site Scripting (XSS) flaw in the Wicket jQuery UI WYSIWYG editor. Affected versions are 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier. The issue allows an attacker to submit arbitrary JavaScript code to the WYSIWYG editor, enabling potential exec...
PT-2018-5987
Name of the Vulnerable Software and Affected Versions: Wicket jQuery UI versions 6.28.0 and earlier Wicket jQuery UI versions 7.9.1 and earlier Wicket jQuery UI versions 8.0.0-M8 and earlier Description: A security issue has been discovered in the WYSIWYG editor of Wicket jQuery UI, allowing an...
CVE-2017-15719: Improper Neutralization of Input During Web Page Generation
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor...
GHSA-WPQ7-Q8J4-72JG Auth0-js bypasses CSRF checks
The Auth0.js library has a vulnerability affecting versions below 9.3 that allows an attacker to bypass the CSRF check from the state parameter if it's missing from the authorization response, leaving the client vulnerable to CSRF attacks...
Auth0-js bypasses CSRF checks
The Auth0.js library has a vulnerability affecting versions below 9.3 that allows an attacker to bypass the CSRF check from the state parameter if it's missing from the authorization response, leaving the client vulnerable to CSRF attacks...
@cimpress/simple-auth-wrapper (>=3.0.0, <=6.4.6), @p2/core (>=1.2.0-alpha.0, <=1.2.0) +7 more potentially affected by CVE-2018-7307 via auth0-js (>=9.0.0-beta.5, <=9.2.2)
auth0-js NPM version =9.0.0-beta.5, =3.0.0, =1.2.0-alpha.0, =1.2.0-alpha.0, =1.2.0-alpha.0, =1.3.47, =11.0.0-beta.2, =1.3.0, =1.3.2 - olymp-auth 20.1.42 Source cves: CVE-2018-7307 Source advisory: GHSA-WPQ7-Q8J4-72JG...
@cimpress/simple-auth-wrapper (>=3.0.0, <=6.4.6), @p2/core (>=1.2.0-alpha.0, <=1.2.0) +7 more potentially affected by CVE-2018-7307 via auth0-js (>=9.0.0-beta.5, <=9.2.2)
auth0-js NPM version =9.0.0-beta.5, =3.0.0, =1.2.0-alpha.0, =1.2.0-alpha.0, =1.2.0-alpha.0, =1.3.47, =11.0.0-beta.2, =1.3.0, =1.3.2 - olymp-auth 20.1.42 Source cves: CVE-2018-7307 Source advisory: OSV:GHSA-WPQ7-Q8J4-72JG...
Cross-site Request Forgery (CSRF)
auth0-js is vulnerable to cross-site request forgery CSRF attacks. These attacks are possible if the state parameter is missing in an authorization response...
CVE-2018-6529
XSS vulnerability in htdocs/webinc/js/bscsmsinbox.php in D-Link DIR-868L DIR868LA1FW112b04 and previous versions, DIR-865L DIR-865LREVAFIRMWAREPATCH1.08.B01 and previous versions, and DIR-860L DIR860LA1FW110b04 and previous versions allows remote attackers to read a cookie via a crafted Treturn...