MailEnable Trust Management Vulnerability

MailEnable is a suite of POP3 and SMTP mail servers from MailEnable Australia. A security vulnerability exists in MailEnable versions prior to 8.60. The vulnerability stems from AUTH.TAB incorrectly handling the '%0A' sequence after receiving a password change request. An attacker can exploit the...

jenkins: potential denial of service through cron expression form validation (SECURITY-1193)

A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop...

UBUNTU-CVE-2018-6179

Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension...

Fedora 28 : qutebrowser (2018-61dbd4a787)

This update fix CVE-2018-10895 0 and a few minor bugs. 0 : Due to a CSRF vulnerability affecting the qute://settings page, it was possible for websites to modify qutebrowser settings. Via settings like editor.command, this possibly allowed websites to execute arbitrary code. ---- This version fix...

Cross site scripting

index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab...

CVE-2018-20418: Improper Neutralization of Input During Web Page Generation

index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab...

FormAssembly: xmlrpc.php file is enable it will used for (DOS) and bruteforce attack

Wordpress that have xmlrpc.php enabled for pingbacks, trackbacks, etc. can be made as a part of a huge botnet causing a major DDOS. The website https://www.formassembly.com/ has the xmlrpc.php file enabled and could thus be potentially used for such an attack against other victim hosts. In order ...

CVE-2018-6068

Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2018-6068

Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2018-6068

Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

UBUNTU-CVE-2018-6079

Inappropriate sharing of TEXTURE2DARRAY/TEXTURE3D data between tabs in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Hardcoded credentials

Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

UBUNTU-CVE-2018-6068

Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2018-6068

Removed by vendor...

CVE-2018-6068

CVE-2018-6068 describes an object lifecycle issue in Chrome Custom Tab that could let a remote attacker spoof the Omnibox (URL bar) in Google Chrome prior to 65.0.3325.146. Related connected advisories indicate Chromium/Chrome updates fixed this family of issues around version 65.0.3325.146 (and ...

CVE-2018-6068

Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2018-6068

Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2018-6068: Improper Input Validation

Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

data-tools 'tab-to-csv' function integer overflow vulnerability

data-tools is a command line tool for data extraction, data manipulation and file format conversion. An integer overflow vulnerability exists in the 'tab-to-csv' function of the tab-to-csv.c file in data-tools versions 2017-07-26 and earlier. An attacker can exploit this vulnerability to cause a...

Bashark - Bash Post Exploitation Toolkit

Bashark aids pentesters and security researchers during the post-exploitation phase of security audits. Usage To launch Bashark on compromised host, simply source the bashark.sh script from terminal: $ source bashark.sh Then type help to see Bashark's help menu Features Single Bash script...