CVE-2018-8890

CVE-2018-8890 concerns a vulnerability in the BlackBerry UEM Management Console (versions 12.8.0 and 12.8.1) described as an information disclosure flaw. The issue could let an attacker take over a UEM user’s session and perform administrative actions in the context of that user. Public data prov...

CVE-2018-8890: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability in the Management Console of BlackBerry UEM 12.8.0 and 12.8.1 could allow an attacker to take over a UEM user's session and perform administrative actions in the context of the user...

PT-2018-18693

Name of the Vulnerable Software and Affected Versions BlackBerry UEM versions 12.8.0 through 12.8.1 Description An information disclosure issue in the Management Console could allow an attacker to take over a user's session and perform administrative actions in the context of the user...

Cross site scripting

Cross-site scripting XSS vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor because of the editorNS.Serializer toEditableHtml function in kendo.all.min.js. If the victim accesses the editor, the payload...

PT-2018-12293

Name of the Vulnerable Software and Affected Versions Progress Kendo UI Editor version 2018.1.221 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor due to the editorNS.Serializer to toEditableHtml function in...

CVE-2018-14037: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor because of the editorNS.Serializer toEditableHtml function in kendo.all.min.js. If the victim accesses the editor, the payload...

CVE-2018-1000670

KOHA Library System version 16.11.x up until 16.11.13 and 17.05.x up until 17.05.05 contains a Cross Site Scripting XSS vulnerability in Multiple fields on multiple pages including /cgi-bin/koha/acqui/supplier.pl?op=enter , /cgi-bin/koha/circ/circulation.pl?borrowernumber=number ,...

Security Bulletin: Multiple security vulnerabilities affect the Lifecycle Query Engine (LQE) that is shipped with Jazz Reporting Service (CVE-2016-0316, CVE-2016-0317, CVE-2016-0318, CVE-2016-0319)

Summary There are multiple security vulnerabilities in the Lifecycle Query Engine LQE shipped with Jazz Reporting Service. Vulnerability Details CVEID: CVE-2016-0316 DESCRIPTION: IBM Jazz Reporting Service is vulnerable to cross-site scripting, caused by improper validation of user-supplied input...

Passit: Session not changed after password reset

Hey, I've found a session management in app.passit.io, which can lead to session takeover! Issue: ============== When the password of an account is changed from a session, other sessions doesn't expire! Steps To Reproduce: ====================== 1 we need to use two different browsers ex:- 1...

keycloak: CSRF token fixation

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks...

CVE-2017-15215

Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index.php. If the victim is an administrator, an attacker can for example take over the admin session or change global settings or add/delete links. It is also...

CVE-2017-15215

Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index.php. If the victim is an administrator, an attacker can for example take over the admin session or change global settings or add/delete links. It is also...

CVE-2017-15215: Improper Neutralization of Input During Web Page Generation

Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index.php. If the victim is an administrator, an attacker can for example take over the admin session or change global settings or add/delete links. It is also...

CVE-2017-15215

Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index.php. If the victim is an administrator, an attacker can for example take over the admin session or change global settings or add/delete links. It is also...

CVE-2017-15215

Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index.php. If the victim is an administrator, an attacker can for example take over the admin session or change global settings or add/delete links. It is also...

PT-2017-13910

Name of the Vulnerable Software and Affected Versions Shaarli version 0.9.1 Description The issue allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to "index.php". If the victim is an administrator, an attacker can take over the admin session, change global...

CVE-2017-7405: Improper Authentication

On the D-Link DIR-615 before v20.12PTb04, once authenticated, this device identifies the user based on the IP address of his machine. By spoofing the IP address belonging to the victim's host, an attacker might be able to take over the administrative session without being prompted for...

PT-2017-17713

Name of the Vulnerable Software and Affected Versions D-Link DIR-615 versions prior to 20.12PTb04 Description The issue allows an attacker to take over an administrative session without authentication credentials by spoofing the IP address of the victim's host. An attacker can obtain the victim's...

Inflection: Session ID is accessible via XSS

Researcher found a vulnerability in the authentication flow that, when chained with an XSS vulnerability could lead to session take over...

Verizon Patches XSS Issues in its Messaging Client

Verizon late last year patched a vulnerability in its Message+ messaging client that could have allowed an attacker to take over a session and possibly extend their reach into a user’s account management settings. Researcher Randy Westergren yesterday disclosed some details on the bug, which coul...