PT-2018-16183 · Nextcloud · Nextcloud Contacts

Name of the Vulnerable Software and Affected Versions: Nextcloud Contacts versions prior to 2.1.2 Description: The issue is related to a missing sanitization of search results for an autocomplete field, which could lead to a stored XSS requiring user-interaction. This missing sanitization only...

PT-2018-16182 · Nextcloud · Nextcloud Calendar

Name of the Vulnerable Software and Affected Versions: Nextcloud Calendar versions prior to 1.5.8 Nextcloud Calendar versions prior to 1.6.1 Description: A stored XSS issue exists due to missing sanitization of search results for an autocomplete field, requiring user-interaction. This issue is...

CVE-2018-13002

An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the wFilemanager.php and index.php files of the /grid5/scripts/ modules. The injection point is located in the Project Title and the execution point occurs in the Inhaltsprojekt...

Fastspot BigTree CMS Cross-Site Scripting Vulnerability (CNVD-2018-12266)

Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A cross-site scripting vulnerability exists in /users/create in Fastspot BigTree CMS. A remote attacker can exploit this vulnerability to inject scripts and attack highly...

CVE-2018-1000521

BigTree-CMS contains a Cross Site Scripting XSS vulnerability in /users/create that can result in The low-privileged users can use this vulnerability to attack high-privilegedDeveloper users.. This attack appear to be exploitable via no. This vulnerability appears to have been fixed in after comm...

Cross site scripting

BigTree-CMS contains a Cross Site Scripting XSS vulnerability in /users/create that can result in The low-privileged users can use this vulnerability to attack high-privilegedDeveloper users.. This attack appear to be exploitable via no. This vulnerability appears to have been fixed in after comm...

CVE-2018-1000521

BigTree-CMS contains a Cross Site Scripting XSS vulnerability in /users/create that can result in The low-privileged users can use this vulnerability to attack high-privilegedDeveloper users.. This attack appear to be exploitable via no. This vulnerability appears to have been fixed in after comm...

CVE-2018-7681

Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the user has certain administrative privileges then this vulnerability can impact other users in the system...

Stored XSS in calendar via group shares (NC-SA-2018-004)

A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins...

Stored XSS in contacts via group shares (NC-SA-2018-005)

A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins...

Cross site scripting

CheckSec Canopy 3.x before 3.0.7 has stored XSS via the Login Page Disclaimer, allowing attacks by low-privileged users against higher-privileged users...

CVE-2018-9036

CheckSec Canopy 3.x before 3.0.7 has stored XSS via the Login Page Disclaimer, allowing attacks by low-privileged users against higher-privileged users...

CVE-2018-9036

CheckSec Canopy 3.x before 3.0.7 has stored XSS via the Login Page Disclaimer, allowing attacks by low-privileged users against higher-privileged users...

Security Bulletin: User sessions running with root GID in IBM SPSS Modeler (CVE-2014-3038)

Summary IBM SPSS Modeler running on Unix platforms contains a vulnerability that could allow a local attacker to gain access to files that normally would only be available to privileged users. The server authenticates a user and spawns a new process that runs in the context of the authenticated...

Security Bulletin: Insufficient authorization check for project actions in WebSphere Lombardi Edition (CVE-2014-4844)

Summary By using WebSphere Lomabrdi Edition WLE you can import and export process applications and toolkits. Although this functionality is available only to authorized users, the actual server side code accepts requests from lower privileged users. Vulnerability Details CVE ID: CVE-2014-4844 CVS...

CVE-2017-7761

The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction a form of symbolic link, protected files in the target directory of the junction can be deleted by the Mozilla Maintenance...

CVE-2017-7761

The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction a form of symbolic link, protected files in the target directory of the junction can be deleted by the Mozilla Maintenance...

CVE-2017-7761

The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction a form of symbolic link, protected files in the target directory of the junction can be deleted by the Mozilla Maintenance...

CVE-2018-7949

The iBMC Intelligent Baseboard Management Controller of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specially crafted login messages to the affected products. Due to improper authentication design, successful exploit enables low privileged users ...

QEMU: cirrus: OOB access when updating VGA display

Quick Emulator aka QEMU, when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service out-of-bounds access and QEMU process crash by leveraging incorrect region calculation when updating VGA display...