Stripo Inc: Stored XSS at "Conditions " through "My Custom Rule" Field at [https://my.stripo.email/cabinet/#/template-editor/] in Template Editor.

Summary: Hi Team, There is "Stored XSS" in "Conditions" . When creating "My Custom Rule", you have to provide a name, whereas "My Custom Rule " field does not properly sanitize the input provided by the User leading to Stored XSS. Other fields are properly sanitizing the input. See the video Pock...

CVE-2020-15849

Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for...

CVE-2020-15487

Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution i...

Huawei EulerOS: Security Advisory for unbound (EulerOS-SA-2020-2021)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP3 : spamassassin (EulerOS-SA-2020-2118)

According to the version of the spamassassin package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.CVE-2018-11781 Note that Tenable Network Security has...

Observium cross-site scripting vulnerability (CNVD-2020-62446)

Observium is a low-maintenance auto-discovery network monitoring platform that supports multiple device types, platforms and operating systems. Observium suffers from a cross-site scripting vulnerability. An attacker can exploit this vulnerability to inject and store malicious JavaScript code via...

CVE-2020-25146

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting XSS due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via laid to the /syslogrules URI for editsyslogrule...

CVE-2020-25139

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting XSS due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via laid to the /syslogrules URI for deletesyslogrule,...

PT-2020-15982

Name of the Vulnerable Software and Affected Versions Observium Professional, Enterprise & Community version 20.8.10631 Description The issue allows for Cross-Site Scripting XSS due to the possibility of injecting and storing malicious JavaScript code. This can occur via the la id variable to the...

CVE-2020-25490

Lack of cryptographic signature verification in the Sqreen PHP agent daemon before 1.16.0 makes it easier for remote attackers to inject rules for execution inside the virtual machine...

PT-2020-16098

Name of the Vulnerable Software and Affected Versions Sqreen PHP agent daemon versions prior to 1.16.0 Description The issue is related to the lack of cryptographic signature verification in the Sqreen PHP agent daemon, making it easier for remote attackers to inject rules for execution inside th...

CVE-2020-25490: Improper Verification of Cryptographic Signature

Lack of cryptographic signature verification in the Sqreen PHP agent daemon before 1.16.0 makes it easier for remote attackers to inject rules for execution inside the virtual machine...

ModSecurity 3.0.x Denial Of Service Vulnerability

ModSecurity version 3.0.x suffers from a denial of service vulnerability due to the handling of regular expression matching. ModSecurity version 3.0.x is affected by a denial of service vulnerability due to the global matching of regular expressions. The combination of a non-anchored regular...

PT-2020-21353

Name of the Vulnerable Software and Affected Versions graphql-shield versions prior to 6.0.6 Description The issue concerns an Authorization Bypass in the graphql-shield library. It is caused by the rule caching option no cache relying on keys generated by cryptographically insecure functions,...

"Shadankun Server Security Type" vulnerable to denial-of-service (DoS)

Overview "Shadankun Server Security Type" provided by Cyber Security Cloud , Inc. contains a denial-of-service DoS vulnerability. When "Rule id"s assigned by the product's internal script overlap, it would not be able to add newly detected attack source IP addresses as the blocking targets CWE-70...

URI Blocked Due to Exclusion Rule

Requests to the URI were blocked due to a matching Exclusion rule. No source data...

JVN#42665874: "Shadankun Server Security Type" vulnerable to denial-of-service (DoS)

"Shadankun Server Security Type" provided by Cyber Security Cloud , Inc. contains a denial-of-service DoS vulnerability. When "Rule id"s assigned by the product's internal script overlap, it would not be able to add newly detected attack source IP addresses as the blocking targets CWE-703. The...

EulerOS 2.0 SP8 : unbound (EulerOS-SA-2020-1886)

According to the version of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP...

EAP: field-name is not parsed in accordance to RFC7230

A flaw was discovered in JBoss EAP, where it does not process the header field-name in accordance with RFC7230. Whitespace between the header field-name and colon is processed, resulting in an HTTP response code of 200 instead of a bad request of 400...

New OCR-ready risk analysis: Why the confusion?

Are you ready for an Office for Civil Rights OCR investigation? Will your risk analysis and risk management methodologies and documents be sufficient to meet the HIPAA Security Rule?...