CVE-2018-0474 Cisco Unified Communications Manager Digest Credentials Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view digest credentials in clear text. The vulnerability is due to the incorrect inclusion of saved passwords in configuration pages. An attacker could...

The vulnerability of the software controller for the centralized control of wireless networks by D-Link Central WiFi Manager arises from the lack of measures taken to protect the website structure. This allows a hacker to inject arbitrary code into the uploaded web page.

The vulnerability of the addUser function in the software controller for D-Link Central WiFi Manager exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the uploaded web page remotely...

The vulnerability of the UpdateSite function in the software controller for centralized control of wireless networks by D-Link Central WiFi Manager allows a intruder to inject any arbitrary code into the uploaded web page.

The vulnerability of the UpdateSite function in the software controller for D-Link Central WiFi Manager exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the uploaded web page remotely...

CVE-2018-6140

Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension...

Code injection

Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension...

CVE-2018-6140

Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension...

Cisco Unified Communications Manager Digest Credentials Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view digest credentials in clear text. The vulnerability is due to the incorrect inclusion of saved passwords in configuration pages. An attacker could...

Content Spoofing

django is vulnerable to content spoofing attacks. The vulnerability exists in the default 404 pages where request.path was not sanitized and can be used to display unwanted HTML on the default 404 pages...

Debian DLA-1629-1 : python-django security update

It was discovered that there was a content-spoofing vulnerability in the default 404 pages in the Django web development framework. For more information, please see : https://www.djangoproject.com/weblog/2019/jan/04/security-releases/ For Debian 8 'Jessie', this issue has been fixed in...

GitLab: A profile page of a user can be denied from loading by appending .html to the username

Summary: I was able to create a user with the username "dashboard.html". Once, the account is set up, when the user clicks on his profile, the actual dashboard will show up instead of his profile page. Same can be done for all the HTML pages in GitLab. Steps To Reproduce: 1. Register a new user...

Fedora 28 : cobbler (2018-1d2a79fe1c)

Fix empty man pages ---- - Revert bindmanageipmi feature that is broken on 2.8 - Use pathfix.py to fix python shebangs ---- - Update to 2.8.4 Fixes BZ 1613292, 1643860, 1614433, CVE-2018-1000226, CVE-2018-10931 - Make koan require python2-ethtool BZ 1638933 Note that Tenable Network Security has...

Fedora 29 : cobbler (2018-22c609e92a)

Fix empty man pages ---- - Revert bindmanageipmi feature that is broken on 2.8 - Use pathfix.py to fix python shebangs ---- - Update to 2.8.4 Fixes BZ 1613292, 1643860, 1614433, CVE-2018-1000226, CVE-2018-10931 - Make koan require python2-ethtool BZ 1638933 Note that Tenable Network Security has...

bludit Pages Editor 3.0.0 Arbitrary File Upload Vulnerability

Bludit is an open source and free lightweight blogging CMS Content Management System system.Pages Editor is one of the page editors. A security vulnerability exists in the content upload feature of Pages Editor in Bludit version 3.0.0, which stems from the program's failure to restrict the upload...

The vulnerability in Microsoft Edge and Internet Explorer 11, related to errors in memory object handling mechanisms, allows an attacker to execute arbitrary code.

The vulnerability of Microsoft Edge and Internet Explorer 11 is related to errors in the memory object handling mechanisms. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with user privileges using specially crafted web page content...

CVE-2018-1000811

bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Command Execution. This attack appear to be exploitable via malicious user have to upload a crafted payload containing PHP code...

CVE-2018-1000811

bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Command Execution. This attack appear to be exploitable via malicious user have to upload a crafted payload containing PHP code...

Kaspersky: Certificate warnings and similar UI elements in Web protection of Anti-Virus products family are susceptible to clickjacking

Summary Clickjacking can be used to trick users into overriding certificate warnings, disabling Safe Money functionality or phishing alerts. Description On certificate warning pages, a single click is sufficient to trigger overriding a wrong certificate. While an additional warning is displayed...

[SECURITY] Fedora 28 Update: php-7.2.13-2.fc28

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

Adobe Acrobat Pro DC HTML2PDF HTML Parsing Use-After-Free Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Mozilla Firefox Unauthorized Access Vulnerability (CNVD-2018-25864)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 64. A remote attacker can exploit this vulnerability to load WebExtension content scripts to about: pages, which could...