CentOS Web Panel Cross-Site Scripting Vulnerability

CentOS Web Panel is a CentOS Lnuix system administration panel. A cross-site scripting vulnerability exists in the index.php file in CentOS Web Panel 0.9.8.12 and earlier versions. A remote attacker can exploit this vulnerability by sending the 'id' parameter to the phpinieditor module or the...

CVE-2018-5962

index.php in CentOS-WebPanel.com aka CWP CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpinieditor module or the emailaddress parameter to the mailadd-new module...

PT-2018-17250 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel versions through v0.9.8.12 Description: The issue concerns an XSS vulnerability. It can be exploited via the id parameter to the phpini editor module or the email address parameter to the mail add-new module in the index.php...

Atlassian JIRA Cross-Site Request Forgery Vulnerability (CNVD-2018-03164)

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A cross-site request forgery vulnerability exists in the IncomingMailServers resource in Atlassian Jira versions prior to 7.6.2....

Debian: Security Advisory (DLA-896-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Dotclear admin/auth.php file cross-site scripting vulnerability

Dotclear is a software developer Olivier Meunier developed a free PHP and MySQL-based blog Blog publishing software. A cross-site scripting vulnerability exists in the admin/auth.php file in Dotclear version 2.12.1. This vulnerability can be exploited by remote attackers to inject arbitrary web...

CVE-2017-16862

The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-site request forgery CSRF vulnerability...

CVE-2017-16862

The CVE-2017-16862 issue affects Atlassian Jira’s IncomingMailServers resource. A CSRF vulnerability in Jira versions before 7.6.2 lets remote attackers modify the coming mail whitelist setting. The problem arises from the CSRF in the IncomingMailServers component, enabling manipulation without ...

CVE-2017-16862

The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-site request forgery CSRF vulnerability...

[SECURITY] Fedora 27 Update: awstats-7.6-8.fc27

Advanced Web Statistics is a powerful and featureful tool that generates advanced web server graphic statistics. This server log analyzer works from command line or as a CGI and shows you all information your log contai ns, in graphical web pages. It can analyze a lot of web/wap/proxy servers lik...

Bitcoin Blackmail by Snail Mail Preys on Those with Guilty Conscience

KrebsOnSecurity heard from a reader whose friend recently received a remarkably customized extortion letter via snail mail that threatened to tell the recipient's wife about his supposed extramarital affairs unless he paid $3,600 in bitcoin. The friend said he had nothing to hide and suspects thi...

Buffer overflow

A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data that is mishandled in an "Open from mail box" action...

CVE-2017-17946

A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data that is mishandled in an "Open from mail box" action...

CVE-2017-17946

A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data that is mishandled in an "Open from mail box" action...

[SECURITY] Fedora 27 Update: thunderbird-52.5.2-1.fc27

Mozilla Thunderbird is a standalone mail and newsgroup client...

[SECURITY] Fedora 26 Update: thunderbird-52.5.2-1.fc26

Mozilla Thunderbird is a standalone mail and newsgroup client...

A week in security (January 1 – January 7)

New year, new threats, as 2018 gets underway. On our blog, we had dubious searches aplenty for those hunting for Malwarebytes information, and we also covered the huge Meltdown/Spectre bug, affecting hardware going back to 10 years. Other news Coin miners are at it again, with a proof of concept...

SA161: Local Information Disclosure Due to Meltdown and Spectre Attacks

SUMMARY Symantec Network Protection products, which run on an affected CPU chipset and execute arbitrary code from external sources, are susceptible to several information disclosure vulnerabilities aka Meltdown and Spectre attacks. A remote attacker, with the ability to execute arbitrary code...

Nylas Mail Lives Information Disclosure Vulnerability

Nylas Mail Lives is an open source, extensible desktop mail application. A security vulnerability exists in Nylas Mail Lives version 2.2.2, which stems from the program assigning 0755 privileges to $HOME/.nylas-mail. A local attacker can exploit the vulnerability to obtain sensitive authenticatio...

TYPO3 Direct Mail Extended Authentication Bypass Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. direct Mail is one of the extensions to send mail without the need for SMTP servers . An authentication bypass vulnerability exists in the TYPO3 Direct Mail extension. An attacke...