Cross site scripting

Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user admin...

CVE-2016-4807

Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user admin...

CVE-2016-4807

Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user admin...

firewalld: Firewall configuration can be modified by any logged in user

A flaw was found in the way firewalld allowed certain firewall configurations to be modified by unauthenticated users. Any locally logged in user could use this flaw to tamper or change firewall settings...

Cross-site request forgery vulnerability in WordPress plugin WP-OliveCart

Overview WP-OliveCart provided by Olive Design is a WordPress plugin to construct a shopping site. WP-OliveCart contains cross-site request forgery vulnerability. Gen Sato of TRADE WORKS Co.,Ltd Security Dept. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under...

"Check available times" function in Cybozu Garoon vulnerable to cross-site scripting

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. "Check available times" function in Cybozu Garoon contains a cross-site scripting vulnerability. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated...

Cybozu Mailwise contains issue in preventing clickjacking attacks

Overview Cybozu Mailwise contains multiple pages for editing/sending bulk emails. Some of these pages fail to protect against clickjacking attacks. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the...

NUUO NVRmini 2 Cross-Site Request Forgery Vulnerability

NUUO provides a stable and high performance digital networked surveillance system. NUUO NVRmini 2 Cross-Site Request Forgery Vulnerability. When a logged in user visits a malicious web site, an attacker can exploit this vulnerability to perform certain actions with administrative privileges...

RubyGems Administrate Cross-Site Request Forgery Vulnerability

RubyGems is a Ruby package manager organized by RubyGems.Administrate is one of the plugins that supports developers to customize the content. A cross-site request forgery vulnerability exists in RubyGems Administrate versions prior to 0.1.5. An attacker could use this vulnerability to perform...

NEC Aterm WF800HP Cross-Site Request Forgery Vulnerability

The NEC Aterm WF800HP is a wireless router product from Nippon Electric NEC. A cross-site request forgery vulnerability exists in the NEC Aterm WF800HP using firmware Ver1.0.17 and earlier. An attacker can exploit this vulnerability to perform an unauthorized operation by tricking a logged-in use...

Multiple Corega wireless LAN routers vulnerable to cross-site request forgery

Overview Multiple wireless LAN routers provided by Corega Inc contain a cross-site request forgery vulnerability CWE-352. Yutaka Kokubu and Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc. and Ueki Shuya reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

WordPress Sola Support Ticket Plugin <= 3.12 - Multiple Vulnerabilities

Anyone, who is logged in user and access to wp-admin, can update settings, allowing HTML to be analyzed. For this reason, information can be obtained. Solution Update the plugin...

Microsoft Office RCE Vulnerability

Microsoft Outlook is an e-mail client software bundled with the Office suite from Microsoft USA. The software manages e-mail, contacts, calendars, and more. A security vulnerability exists in Microsoft Outlook, which arises from a failure of the program to properly handle specially designed e-mai...

Multiple routers contain issue in preventing clickjacking attacks

Overview Multiple router products contain an issue in the protection against clickjacking attacks. Noriaki Iwasaki of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact If a user...

Dotclear vulnerable to cross-site scripting

Overview Dotclear is a weblog software. Dotclear contains a cross-site scripting vulnerability. Yuji Tounai of NTT Com SecurityJapanKK reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact If a user views a...

(0Day) Borland AccuRev Reprise License Management Server Path Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Borland AccuRev. Authentication is not required to exploit this vulnerability. The specific flaw exists within the rlmswitchprocess functionality of the Reprise License Manager service. The issue...

WordPress Plugin BuddyPress Activity Plus 'admin-ajax' Cross-Site Request Forgery Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin BuddyPress Activity Plus 'admin-ajax'. An attacker...

Cacti vulnerable to cross-site request forgery

Overview Cacti is a web application that graphs stored data collected from network devices. Cacti contains a cross-site request forgery vulnerability CWE-352. Masako Ohno reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

WordPress Plugin WPS Hide Login Cross-Site Request Forgery Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites on PHP and MySQL servers.WPS Hide Login is one of the plug-ins to change the URL of the login form. A cross-site request forgery vulnerability exis...

WordPress plugin Contact Form DB cross-site request forgery vulnerability

WordPress is the WordPress Software Foundation's suite of blogging platforms developed in the PHP language, which supports personal blog sites on PHP and MySQL servers.Contact Form DB also known as CFDB and contact-form-7-to-database-extension is one of the plugins that can submit the create and...