IBM Engineering Requirements Management DOORS Next Cross-Site Scripting Vulnerability

IBM Engineering Requirements Management DOORS Next is a scalable solution that helps optimize communication and collaboration among teams and project stakeholders to maximize productivity and quality. A cross-site scripting vulnerability exists in the IBM Engineering Requirements Management DOORS...

Inter skimming kit used in homoglyph attacks

As we continue to track web threats and credit card skimming in particular, we often rediscover techniques weve encountered elsewhere before. In this post, we share a recent find that involves what is known as an homoglyph attack. This technique has been exploited for some time already, especiall...

CVE-2019-4091: Improper Neutralization of Input During Web Page Generation

"HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for users in Dashboard, potentially giving an attacker ability to inject malicious code into the system. "...

WSO2 3.1.0 - Persistent Cross-Site Scripting Vulnerability

Exploit for java platform in category web applications Title: WSO2 3.1.0 - Persistent Cross-Site Scripting Author: raki ben hamouda Vendor: https://apim.docs.wso2.com Softwrare link: https://apim.docs.wso2.com/en/latest/ CVE: N/A Advisory:...

PT-2020-20402

Name of the Vulnerable Software and Affected Versions Tiki-Wiki CMS versions through 20.0 Description The issue is related to an Improper Neutralization of Script-Related HTML Tags in a Web Page, also known as Basic XSS. This allows malicious users to inject malicious code fragments, such as...

Cross-site Scripting (XSS)

fec-style is vulnerable to cross-site scripting XSS attacks. The attack is possible due to improper sanitization of query string in the URL which determines all the characters are safe for filter values, allowing an attacker to inject malicious code...

CVE-2019-19979: Improper Neutralization of Input During Web Page Generation

A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject malicious code affecting site visitors. There was CSRF with resultant XSS...

CVE-2019-18571

The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a reflected cross-site scripting vulnerability in the My Access Live module MAL. An authenticated malicious local user could potentially exploit this vulnerability by sending crafted...

Nextcloud: Downgrade encryption scheme and break integrity through known-plaintext attack

The idea behind the Server Side Encryption is that you can move your encrypted files to an external party without that external party being able to to read or modify those files. Some time ago, Nextcloud switched from unauthenticated CFB cipher block mode to authenticated CTR cipher block mode in...

PT-2019-15230

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue is related to a security problem where an attacker can inject malicious code. The estimated number of potentially affected devices is not provided. Technical details about exploitation include the...

The vulnerability of the File Signature Security function in the Windows operating system allows a hacker to circumvent existing security restrictions and introduce malicious code into a CAB file without canceling the file’s signature.

The vulnerability of the File Signature Security function in the Windows operating system is related to errors in checking the signatures of CAB files. Exploiting this vulnerability allows a hacker to bypass existing security restrictions and inject malicious code into CAB files without...

Supply-Chain Attack against the Electron Development Platform

Electron is a cross-platform development system for many popular communications apps, including Skype, Slack, and WhatsApp. Security vulnerabilities in the update system allows someone to silently inject malicious code into applications. From a news article: At the BSides LV security conference o...

HT2 Labs Learning Locker Cross-Site Scripting Vulnerability

HT2 Labs Learning Locker is an open source learning record repository. A security vulnerability exists in HT2 Labs Learning Locker version 3.15.1. An attacker can exploit this vulnerability to inject malicious HTML and JavaScript code into the DOM of a website...

CVE-2019-12774

A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 70044update05032019-482 that could allow an unauthenticated threat actor to inject malicious code directly into the application. This affects, for example, the Profile Description...

PT-2019-16729

Name of the Vulnerable Software and Affected Versions Cloud Foundry cf-deployment versions prior to 7.9.0 Description The issue concerns the use of an insecure protocol by java components in Cloud Foundry cf-deployment to fetch dependencies during the building process. This could allow a remote...

CVE-2019-3801: Download of Code Without Integrity Check

Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component...

WS-2019-0061

Klaxon JARs that were downloaded insecurely can be injected with malicious code during a MitM Men in the Middle Attack...

Stored cross-site scripting vulnerability in JYmusic frontend (CNVD-2019-13273)

JYmusic is an open source cross-platform music management system. JYmusic frontend has a stored cross-site scripting vulnerability, an attacker can insert malicious js code in the page to obtain user cookies and other information, resulting in user hijacking...

PT-2019-11650

Name of the Vulnerable Software and Affected Versions: Sitemagic CMS version 4.4 Description: The issue concerns a security problem where an attacker can inject malicious code. This is achieved through the filename parameter in the SMFiles/FrmUpload.class.php file. Recommendations: For Sitemagic...

Code injection

Malicious TA can tag QSEE kernel memory and map to EL0, there by corrupting the physical memory as well it can be used to corrupt the QSEE kernel and compromise the whole TEE in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon...