272 matches found
PT-2019-14543
Name of the Vulnerable Software and Affected Versions Liferay Portal versions prior to 7.2.0 GA1 Description The issue allows for XSS via a journal article title to the "journal article/page.jsp" page in "journal/journal-taglib". Recommendations For versions prior to 7.2.0 GA1, update to a versio...
CVE-2019-16147: Improper Neutralization of Input During Web Page Generation
Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journalarticle/page.jsp in journal/journal-taglib...
SUSE SLED15 / SLES15 Security Update : taglib (SUSE-SU-2019:1374-2)
This update for taglib fixes the following issues : CVE-2018-11439: The TagLib::Ogg::FLAC::File::scan function allowed remote attackers to cause information disclosure heap-based buffer over-read via a crafted audio file bsc1096180 Note that Tenable Network Security has extracted the preceding...
SUSE-SU-2019:1374-2 Security update for taglib
This update for taglib fixes the following issues: - CVE-2018-11439: The TagLib::Ogg::FLAC::File::scan function allowed remote attackers to cause information disclosure heap-based buffer over-read via a crafted audio file bsc1096180...
EulerOS 2.0 SP8 : taglib (EulerOS-SA-2019-1662)
According to the version of the taglib package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure heap-based...
Liferay Portal 7.1 CE GA=3 / SimpleCaptcha API - Cross-Site Scripting Vulnerability
Exploit for jsp platform in category web applications Exploit Title: Liferay Portal ” / or ” /. A customized Liferay portlet which directly calls the Simple Captcha API without sanitizing the input could be susceptible to this vulnerability. Poc In a sample scenario of custom code calling the ” /...
Liferay Portal 7.1 CE GA3 SimpleCaptcha API - Cross-Site Scripting
Liferay Portal 7.1 CE GA3 SimpleCaptcha API - Cross-Site Scripting Exploit Title: Liferay Portal ” / or ” /. A customized Liferay portlet which directly calls the Simple Captcha API without sanitizing the input could be susceptible to this vulnerability. Poc In a sample scenario of custom code...
Liferay Portal 7.1 CE GA=3 / SimpleCaptcha API - Cross-Site Scripting
Exploit Title: Liferay Portal ” / or ” /. A customized Liferay portlet which directly calls the Simple Captcha API without sanitizing the input could be susceptible to this vulnerability. Poc In a sample scenario of custom code calling the ” / JSP taglib, appending a payload like the following to...
CVE-2019-6588
In CVE-2019-6588, Liferay Portal versions prior to 7.1 CE GA4 are vulnerable via the SimpleCaptcha API. The XSS occurs when unsanitized input is passed into the url parameter of the JSP taglibs or . Liferay Portal out-of-the-box behavior with no customizations is not vulnerable. The vulnerabilit...
PT-2019-18170
Name of the Vulnerable Software and Affected Versions Liferay Portal versions prior to 7.1 CE GA4 Description A security issue exists in the SimpleCaptcha API when custom code passes unsanitized input into the url parameter of the JSP taglib call, such as " / or " /. This issue does not affect...
CVE-2019-6588: Improper Neutralization of Input During Web Page Generation
In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call or . Liferay Portal out-of-the-box behavior with no customizations is not vulnerable...
Cross-site Scripting (XSS)
com.liferay.frontend.taglib is vulnerable to cross-site scripting XSS. The vulnerability exists because the attribute value in a bookmark URL is not escaped, allowing an attacker to inject malicious script through it...
openSUSE Security Update : taglib (openSUSE-2019-432)
This update for taglib fixes this security issues : - CVE-2018-11439: The TagLib::Ogg::FLAC::File::scan function allowed remote attackers to cause information disclosure heap-based buffer over-read via a crafted audio file bsc1096180. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...
Debian DLA-1430-1 : taglib security update
CVE-2018-11439 Fix for a heap-based buffer over-read via a crafted audio file. For Debian 8 'Jessie', these problems have been fixed in version 1.9.1-2.1+deb8u1. We recommend that you upgrade your taglib packages. NOTE: Tenable Network Security has extracted the preceding description block direct...
Debian: Security Advisory (DLA-1430-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DLA 1430-1] taglib security update
Package : taglib Version : 1.9.1-2.1+deb8u1 CVE ID : CVE-2018-11439 CVE-2018-11439 Fix for a heap-based buffer over-read via a crafted audio file. For Debian 8 "Jessie", these problems have been fixed in version 1.9.1-2.1+deb8u1. We recommend that you upgrade your taglib packages. Further...
DLA-1430-1 taglib - security update
Bulletin has no description...
MGASA-2018-0300 Updated taglib packages fix security vulnerability
The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure heap-based buffer over-read via a crafted audio file. CVE-2018-11439...
Updated taglib packages fix security vulnerability
The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure heap-based buffer over-read via a crafted audio file. CVE-2018-11439...
openSUSE Security Update : taglib (openSUSE-2018-627)
This update for taglib fixes this security issues : - CVE-2018-11439: The TagLib::Ogg::FLAC::File::scan function allowed remote attackers to cause information disclosure heap-based buffer over-read via a crafted audio file bsc1096180. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...