CVE-2018-16249

In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated us...

Security Bulletin: Multiple vulnerabilities in jackson-databind affect IBM Platform Symphony and IBM Spectrum Symphony

Summary Multiple vulnerabilities exist in the Jackson databind, core, and annotations version used by IBM Spectrum Symphony 7.2.1, 7.2.0.2, and 7.1.2, and IBM Platform Symphony 7.1.1 and 7.1 Fix Pack 1. Interim fixes that provide instructions on upgrading Jackson databind, core, and annotations t...

Security Bulletin: Remote code execution vulnerability (CVE-2019-3778) affects IBM Spectrum Symphony 7.2.0.2 and 7.2.1

Summary Interim fixes are needed to upgrade the Spring Security OAuth package in IBM Spectrum Symphony 7.2.0.2 and 7.2.1 to resolve the remote code execution vulnerability CVE-2019-3778. Vulnerability Details CVE-ID: CVE-2019-3778 Description: Spring Security OAuth could allow a remote attacker t...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Platform Symphony and IBM Spectrum Symphony

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 Service Refresh 5 Fix Pack 27 and earlier releases used by IBM Platform Symphony and IBM Spectrum Symphony. IBM Platform Symphony and IBM Spectrum Symphony have addressed the applicable CVEs. IBM is working to...

Symphony Project sfDoctrinesfPropel 1.x Database Password Disclosure

Exploit Title : Symphony Project sfDoctrinesfPropel 1.x Database Password Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 10/05/2019 Vendor Homepage : symfony.com Information : symfony-project.org/reference/14/en/07-Databases Software Versions : 1.x a...

Deserialization Of Untrusted Object

symfony/symfony contains an unsafe deserialization usage. A failure to validate untrusted inputs from user passing to the function unserialize causes deserialization of malicious object, allowing an attacker to inject malicious payloads which can lead to file deletions or raw output being echoed...

Moderate severity vulnerability that affects org.b3log:symphony

An issue was discovered in b3log Symphony aka Sym before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java...

b3log Symphony cross-site scripting vulnerability (CNVD-2019-05664)

b3log Symphony Sym is a modern open source community platform written in the Java language. A cross-site scripting vulnerability exists in versions of b3log Sym prior to 3.4.7, which can be exploited by remote attackers to inject arbitrary web script or HTML by sending the userIntro and...

Code injection

An issue was discovered in b3log Symphony aka Sym before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java...

CVE-2019-9142

An issue was discovered in b3log Symphony aka Sym before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java...

CVE-2019-9142

An issue was discovered in b3log Symphony aka Sym before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java...

CVE-2019-9142

The CVE-2019-9142 issue affects b3log Symphony (Sym) prior to v3.4.7. The vulnerability is an XSS flaw exposed via userIntro and userNickname fields in processor/SettingsProcessor.java. Connections across multiple sources confirm the root cause is input handling in SettingsProcessor.java, leading...

CVE-2019-9142

An issue was discovered in b3log Symphony aka Sym before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java...

Security Bulletin: Privilege escalation in SUID of egosh binary impacts IBM Platform Symphony and IBM Spectrum Symphony

Summary When you start a host in an IBM Platform Symphony cluster with the "egosh ego start" command, the egosh binary is assigned the SUID of the root user and started as root. For users who don’t require root permission, this root access is a potential security issue. This enhancement introduce...

HackerOne: Verbose PHP error messages exposed on a blog article

Hey guys! For what its worth, warning messages aren't suppressed on the /blog/ endpoint, giving verbose PHP error messages when visiting a blog article such as https://www.hackerone.com/blog/H1-702-2018-makes-history-over-500K-bounties-paid. F374066 Impact Not much impact, just disclosures of pat...

IBM Spectrum Symphony Information Disclosure Vulnerability

IBM Spectrum Symphony is a suite of enterprise-class management software for running compute- and data-intensive distributed applications on shared grids from IBM in the United States. A security vulnerability exists in IBM Spectrum Symphony versions 7.1.2 and 7.2.0.2. The vulnerability can be...

IBM Spectrum Symphony Cross-Site Scripting Vulnerability

IBM Spectrum Symphony is enterprise-class software that distributes and virtualizes compute-intensive application services and processes across existing heterogeneous IT resources. A cross-site scripting vulnerability exists in IBM Spectrum Symphony. The vulnerability can be exploited by a user t...

Cross site scripting

IBM Spectrum Symphony 7.2.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 146341...

CVE-2018-1706

IBM Spectrum Symphony 7.2.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 146341...

CVE-2018-1706

IBM Spectrum Symphony 7.2.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 146341...