Cross site scripting

VMware Horizon Server 7.x prior to 7.10.3 or 7.13.0 contains a Cross Site Scripting XSS vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed...

CVE-2020-3997

VMware Horizon Server 7.x prior to 7.10.3 or 7.13.0 contains a Cross Site Scripting XSS vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed...

CrimeOps of the KashmirBlack Botnet – Part II

Introduction The previous blog - “CrimeOps of the KasmirBlack Botnet - Part I” - described the DevOps behind the botnet. It showed how its well-designed infrastructure makes it easy to expand and add new exploits or payloads without much effort,and explained the evolution and version deployment o...

Cross-site Scripting (XSS)

lightning-server is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute malicious script in a user's browser via an error message in the session controller's addData function...

Adobe Magento Cross-Site Scripting Vulnerability

Adobe Magento is the U.S. Odobie Adobe company's set of open source PHP e-commerce system. The system provides rights management , search engine and payment gateway and other functions.Magento Open Source is the open source version of Magento.Magento Commerce is the commercial version of Magento....

ALERT! Hackers targeting IoT devices with a new P2P botnet malware

Cybersecurity researchers have taken the wraps off a new botnet hijacking Internet-connected smart devices in the wild to perform nefarious tasks, mostly DDoS attacks, and illicit cryptocurrency coin mining. Discovered by Qihoo 360's Netlab security team, the HEH Botnet — written in Go language a...

CVE-2020-25626

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious tags, leadin...

[ASA-202009-7] netbeans: arbitrary code execution

Arch Linux Security Advisory ASA-202009-7 ========================================= Severity: Critical Date : 2020-09-14 CVE-ID : CVE-2020-11986 Package : netbeans Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1221 Summary ======= The package netbeans befo...

Security Bulletin: IBM Kenexa LCMS Premier On Premise - [All] jQuery (Publicly disclosed vulnerability) CVE-2020-11023, CVE-2020-11022

Summary We have identified that the IBM Kenexa LCMS Premier is affected by one or more security vulnerabilities. These have been addressed in LCMS Premier 14.0 version. Vulnerability Details CVEID: CVE-2020-11023 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper...

Malicious Package in ladder-text-js

ladder-text-js contained a malicious script that attempted to delete all files when npm test was run. Recommendation This module has been unpublished from the npm Registry. If you find this module in your environment remove it...

GHSA-33GC-F8V9-V8HM Malicious Package in ladder-text-js

ladder-text-js contained a malicious script that attempted to delete all files when npm test was run. Recommendation This module has been unpublished from the npm Registry. If you find this module in your environment remove it...

Cross site scripting

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

Cross-Site Scripting (XSS)

Symphony CMS is susceptible to cross-site scripting XSS. Lack of sanitization for the name field to appendSubheading, allowing an attacker to inject malicious script through it...

CVE-2020-6872

The server management software module of ZTE has a storage XSS vulnerability. The attacker inserts some attack codes through the foreground login page, which will cause the user to execute the predefined malicious script in the browser. This affects...

Introducing Page Integrity Manager

On May 26, Akamai launched our Page Integrity Manager, extending our solutions for securing and delivering digital experiences. During beta, we monitored more than one trillion real-user interactions to understand script composition and behavior. Above all, one thing stood out: Scripts loaded in...

McAfee Total Protection Backlink Vulnerability

McAfee Total Protection MTP is a suite of antivirus software from the American company McAfee. A security vulnerability exists in McAfee MTP versions prior to 16.0.R26. A local attacker can exploit the vulnerability to delete files without authorization via a malicious script or program...

CVE-2020-7282

Privilege Escalation vulnerability in McAfee Total Protection MTP before 16.0.R26 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious...

CVE-2020-7282

Privilege Escalation vulnerability in McAfee Total Protection MTP before 16.0.R26 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious...

Privilege escalation

Privilege Escalation vulnerability in McAfee Total Protection MTP before 16.0.R26 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious...

Privilege escalation

Privilege Escalation vulnerability in McAfee Total Protection MTP before 16.0.R26 allows local users to create and edit files via symbolic link manipulation in a location they would otherwise not have access to. This is achieved through running a malicious script or program on the target machine...