CVE-2017-1000035

Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack...

CVE-2017-1000035

Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack...

Concrete CMS: Stored XSS vulnerability in RSS Feeds Description field

Intro "Pirates of the Crayons" Type of issue: Core CMS issue Level of severity: Internal Attack Vector Concrete5 version: 8.2.0 RC2 rev. b54f2b451f0a0804699c4cf9f0b3a8fef0e407db July 10th Summary There is Stored XSS vulnerability in RSS Feeds Description property. Value of the textarea is not...

Metasploit Wrapup

Metasploit Hackathon We were happy to host the very first Metasploit framework open source hackathon this past week in the Rapid7 Austin. Eight Metasploit hackers from outside of Rapid7 joined forces with the in-house team and worked on a lot of great projects, small and large. @bcook started the...

Sensitive Information Disclosure

moodle/moodle is vulnerable to information disclosure attacks. A flaw in blog/rsslib.php continues to provide a blog RSS feed when blogging is disabled. Attackers can leverage this feed to obtain sensitive information...

Authentication flaw

Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors...

CVE-2016-4908

Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors...

CVE-2016-4908

Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors...

CVE-2016-4908

CVE-2016-4908 affects Cybozu Garoon 3.0.0–4.2.2, where an access restriction flaw in the RSS settings allows remote authenticated attackers to bypass protections and alter or delete another user’s private RSS settings via unspecified vectors. The OpenVAS/JVN entries and CVE records corroborate an...

Sensitive Information Leak

Moodle is vulnerable to a sensitive information leak. blog/rsslib.php does not prevent guest users from accessing sensitive information from hidden blog posts through related RSS feeds for site-level blogs...

Bypass Access Restrictions

Moodle is vulnerable to access restrictions being bypassed. Authenticated users can leverage the student role to bypass access restrictions and read the RSS feed for a forum. This is possible because mod/forum/rsslib.php does not correctly implement the requirement for posting before reading a Q...

Beers with Talos Podcast Now Available

The first episodes of Beers with Talos are now available on iTunes and directly on talosintelligence.com/podcasts.When Talos decided to make a threat intelligence podcast, we wanted to make it different than your typical buttoned down, subdued security podcast. The BWT crew: Craig, Joel, a...

CVE-2017-5453

A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's "TITLE" element. This vulnerability allows for spoofing but no scripted content can be run. This vulnerability affects Firefox 53...

CVE-2017-5453

A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's "TITLE" element. This vulnerability allows for spoofing but no scripted content can be run. This vulnerability affects Firefox 53...

UBUNTU-CVE-2017-5453

A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's "TITLE" element. This vulnerability allows for spoofing but no scripted content can be run. This vulnerability affects Firefox 53...

Concrete CMS: Stored XSS in RSS Feeds Title (Concrete5 v8.1.0)

Summary / Description: The RSS Feeds Title pfTitle= parameter does not correctly sanitize user input. This allows HTML & Javascript to be stored and executed any time someone visits /index.php/dashboard/pages/feeds Steps to Reproduce 1. Open up Firefox 2. Login /index.php/login 3. Visit...

GLSA-201702-26 : Nagios: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201702-26 Nagios: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Nagios. Please review the CVE identifiers referenced below for details. Impact : A local attacker, who either is already Nagioss system us...

Magento RSS Brute Force Attempt

A remote attacker can attempt to obtain login credentials to the built-in RSS feed functionality of the Magento platform using brute force. Successful exploitation would allow an attacker to obtain unauthorized access to the Magento Admin login...

Important: Red Hat Security Advisory: nagios security update

An update for nagios is now available for Red Hat Gluster Storage 3.1 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: nagios security update

An update for nagios is now available for Red Hat Gluster Storage 3.1 for RHEL 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...