6215 matches found
Important: Red Hat Security Advisory: httpd24-httpd security update
An update for httpd24-httpd is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...
Discourse: CSRF-tokens on pages without no-cache headers, resulting in ATO when using CloudFlare proxy (Web Cache Deception)
Hi, I noticed this issue on one of your clients which was using CloudFlare in front of their Discourse. This is not affecting try.discourse.org but the same underlying issue can be seen there as well even though it's not exploitable on that specific domain. The TL;DR of issue is basically:...
httpd: mod_mime buffer overread
A buffer over-read flaw was found in the httpd's modmime module. A user permitted to modify httpd's MIME configuration could use this flaw to cause httpd child process to crash...
httpd: mod_mime buffer overread
A buffer over-read flaw was found in the httpd's modmime module. A user permitted to modify httpd's MIME configuration could use this flaw to cause httpd child process to crash...
[SECURITY] Fedora 26 Update: php-PHPMailer-5.2.24-1.fc26
Full Featured Email Transfer Class for PHP. PHPMailer features: Supports emails digitally signed with S/MIME encryption! Supports emails with multiple TOs, CCs, BCCs and REPLY-TOs Works on any platform. Supports Text & HTML emails. Embedded image support. Multipart/alternative emails for mail...
Cross site scripting
XOOPS Core 2.5.8 has stored XSS in imagemanager.php because of missing MIME type validation in htdocs/class/uploader.php...
CVE-2017-12139
XOOPS Core 2.5.8 has stored XSS in imagemanager.php because of missing MIME type validation in htdocs/class/uploader.php...
CVE-2017-12139
XOOPS Core 2.5.8 has stored XSS in imagemanager.php because of missing MIME type validation in htdocs/class/uploader.php...
CVE-2017-12139
XOOPS Core 2.5.8 has stored XSS in imagemanager.php because of missing MIME type validation in htdocs/class/uploader.php...
CVE-2017-12139
CVE-2017-12139 affects XOOPS Core 2.5.8 with a stored XSS in imagemanager.php due to missing MIME type validation in htdocs/class/uploader.php. The issue is caused by inadequate validation of uploaded content, enabling an attacker to inject malicious script when the affected page is viewed. Conne...
CVE-2017-12139: Improper Neutralization of Input During Web Page Generation
XOOPS Core 2.5.8 has stored XSS in imagemanager.php because of missing MIME type validation in htdocs/class/uploader.php...
PT-2017-12360
Name of the Vulnerable Software and Affected Versions XOOPS Core version 2.5.8 Description The issue is related to stored XSS in imagemanager.php due to missing MIME type validation in htdocs/class/uploader.php. Recommendations For XOOPS Core version 2.5.8, consider validating MIME types in the...
[SECURITY] Fedora 24 Update: php-PHPMailer-5.2.24-1.fc24
Full Featured Email Transfer Class for PHP. PHPMailer features: Supports emails digitally signed with S/MIME encryption! Supports emails with multiple TOs, CCs, BCCs and REPLY-TOs Works on any platform. Supports Text & HTML emails. Embedded image support. Multipart/alternative emails for mail...
[SECURITY] Fedora 25 Update: php-PHPMailer-5.2.24-1.fc25
Full Featured Email Transfer Class for PHP. PHPMailer features: Supports emails digitally signed with S/MIME encryption! Supports emails with multiple TOs, CCs, BCCs and REPLY-TOs Works on any platform. Supports Text & HTML emails. Embedded image support. Multipart/alternative emails for mail...
CVE-2017-7666
Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery CSRF attacks, XSS attacks, click-jacking, and MIME based attacks...
CVE-2017-7666
Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery CSRF attacks, XSS attacks, click-jacking, and MIME based attacks...
Cross site request forgery (csrf)
Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery CSRF attacks, XSS attacks, click-jacking, and MIME based attacks...
CVE-2017-7666: Improper Neutralization of Input During Web Page Generation
Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery CSRF attacks, XSS attacks, click-jacking, and MIME based attacks...
CVE-2017-7666
CVE-2017-7666 affects Apache OpenMeetings 1.0.0 and exposes CSRF, XSS, click‑jacking, and MIME-based attacks. The issue is addressed in OpenMeetings 3.3.0; remediation is to upgrade to at least 3.3.0. Exploitation details are not provided in the supplied documents.