Visma Public: HTML-injection in PDF-export leads to LFI

The researcher was able to extract contents of files using the pdf-generator in "Yearly Financial Statements". This was done by adding an IFRAME-tag inside the companyname. Once rendered in Yearly Financial Statements, it included the file the IFRAME was pointing to. In this POC it was /etc/passw...

CVE-2019-10177

It was found that PDF export component in CloudForms was vulnerable to cross-side scripting XSS as user input was not properly sanitized. An authenticated attacker with privileges to edit compute could use the XSS vulnerability against users, which could lead to arbitrary code execution, and...

Red Hat CloudForms Cross-Site Scripting Vulnerability

Red Hat CloudForms is a hybrid infrastructure management platform from Red Hat, Inc. The platform provides deployment, management, and other capabilities across virtual machines, clouds, containers, and physical infrastructure. A cross-site scripting vulnerability exists in the PDF export module ...

CVE-2019-10177

A stored cross-site scripting XSS vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to...

Cross site scripting

A stored cross-site scripting XSS vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to...

CVE-2019-10177

CloudForms (Red Hat) PDF export module in versions 5.9 and 5.10 is affected by a stored XSS due to unsanitized user input. An attacker with privileges to edit compute can trigger XSS against other users, potentially leading to arbitrary code execution and theft of the higher-privileged user’s ant...

CVE-2019-10177

A stored cross-site scripting XSS vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to...

CVE-2019-10177: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to...

MS16-107: Description of the security update for PowerPoint 2013: September 13, 2016

MS16-107: Description of the security update for PowerPoint 2013: September 13, 2016 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Microsoft Office file. To learn more about these vulnerabilitie...

Oracle Fusion Middleware Outside In Technology Component Denial of Service Vulnerability (CNVD-2015-06850)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platform for enterprise and cloud environments from Oracle Corporation. The platform provides middleware, software collections, and other capabilities. oracle Outside In Technology is one of the software development...

Oracle Fusion Middleware Outside In Technology Component Denial of Service Vulnerability (CNVD-2015-06849)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platform for enterprise and cloud environments from Oracle Corporation. The platform provides middleware, software collections, and other capabilities. oracle Outside In Technology is one of the software development...

CVE-2015-4811

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors related to Outside In PDF Export SDKutside In PDF Export SDK, a different vulnerability than CVE-2015-4809...

Buffer overflow

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors related to Outside In PDF Export SDK, a different vulnerability than CVE-2015-4811...

Buffer overflow

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors related to Outside In PDF Export SDKutside In PDF Export SDK, a different vulnerability than CVE-2015-4809...

CVE-2015-4809

CVE-2015-4809 affects Oracle Outside In Technology (PDF Export SDK) used in Oracle Fusion Middleware 8.5.0/8.5.1/8.5.2. The vulnerability is described as unspecified and local, allowing a denial of service via the Outside In PDF Export SDK. Impact is limited to availability (CVSS v2 base score 1....

CVE-2015-4809

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors related to Outside In PDF Export SDK, a different vulnerability than CVE-2015-4811...

PT-2015-2552

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 8.5.0 through 8.5.2 Description The issue is related to errors in the code of the Oracle Outside In Technology component. It may allow a local attacker to cause a denial of service via vectors related to the...

CVE-2015-4811: Undefined Security Weakness

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors related to Outside In PDF Export SDKutside In PDF Export SDK, a different vulnerability than CVE-2015-4809...

PT-2015-2550

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 8.5.0 through 8.5.2 Description The issue is related to errors in the code of the Oracle Outside In Technology component. It allows local users to affect availability, potentially leading to a denial of servic...

CVE-2015-4809: Undefined Security Weakness

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors related to Outside In PDF Export SDK, a different vulnerability than CVE-2015-4811...