CVE-2016-8613

A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. T...

CVE-2016-8613

A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. T...

Cross site scripting

A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. T...

Cloud Custodian - Rules Engine For Cloud Security, Cost Optimization, And Governance, DSL In Yaml For Policies To Query, Filter, And Take Actions On Resources

Cloud Custodian is a rules engine for AWS fleet management. It allows users to define policies to enable a well managed cloud infrastructure, that's both secure and cost optimized. It consolidates many of the adhoc scripts organizations have into a lightweight and flexible tool, with unified...

Cross-Site Scripting (XSS)

Kohana is affected by a cross-site scripting XSS vulnerability. This is due to the way image tags are stripped in system/classes/Kohana/Security.php, which allows an attacker to inject arbitrary Javascript code by bypassing the stripimagetags protection mechanism...

Microsoft Visual Studio Remote Code Execution Vulnerability

Microsoft Visual Studio is a family of development tool suites from Microsoft, and a largely complete development toolset that includes most of the tools needed throughout the software life cycle. A remote code execution vulnerability exists in Microsoft Visual Studio that stems from the program...

FreeBSD : wordpress -- multiple issues (4740174c-82bb-11e8-a29a-00e04c1ea73d)

wordpressdevelopers reports : Taxonomy: Improve cache handling for term queries. Posts, Post Types: Clear post password cookie when logging out. Widgets: Allow basic HTML tags in sidebar descriptions on Widgets admin screen. Community Events Dashboard: Always show the nearest WordCamp if one is...

[SECURITY] Fedora 27 Update: cantata-2.3.1-1.fc27

Cantata is a graphical client for the music player daemon MPD. Features: Multiple MPD collections. Highly customisable layout. Songs grouped by album in play queue. Context view to show artist, album, and song information of current track. Simple tag editor. File organizer - use tags to organize...

Directory Traversal

github.com/golang/gddo is vulnerable to directory traversal attacks. The vulnerability exists due to the tags in the packages that are fetched by github.com/golang/gddo, allowing directory traversal attacks...

CVE-2018-12976

In Go Doc Dot Org gddo through 2018-06-27, an attacker could use specially crafted tags in packages being fetched by gddo to cause a directory traversal and remote code execution...

USN-3702-2: PHP vulnerability

USN-3702-1 fixed a vulnerability in PHP. PHP 7.2.7 did not actually include the fix for CVE-2018-12882. This update adds a backported patch to correct the issue. We apologize for the inconvenience. Original advisory details: It was discovered that PHP incorrectly handled exif tags in certain...

USN-3702-2 php7.2 vulnerability

USN-3702-1 fixed a vulnerability in PHP. PHP 7.2.7 did not actually include the fix for CVE-2018-12882. This update adds a backported patch to correct the issue. We apologize for the inconvenience. Original advisory details: It was discovered that PHP incorrectly handled exif tags in certain...

Ubuntu: Security Advisory (USN-3702-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 18.04 LTS : PHP vulnerability (USN-3702-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3702-1 advisory. It was discovered that PHP incorrectly handled exif tags in certain images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of...

wordpress -- multiple issues

wordpressdevelopers reports: Taxonomy: Improve cache handling for term queries. Posts, Post Types: Clear post password cookie when logging out. Widgets: Allow basic HTML tags in sidebar descriptions on Widgets admin screen. Community Events Dashboard: Always show the nearest WordCamp if one is...

USN-3702-1 php7.2 vulnerability

It was discovered that PHP incorrectly handled exif tags in certain images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code...

USN-3702-1: PHP vulnerability

It was discovered that PHP incorrectly handled exif tags in certain images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code...

Session fixation

aio-libs aiohttp-session contains a Session Fixation vulnerability in loadsession function for RedisStorage see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttpsession/redisstorage.pyL42 that can result in Session Hijacking. This attack appear to be exploitable via Any method that...

Vanilla: FileUpload Plugin: CSRF (delete all attached files)

Description ------------ The current version 1.9.1 of the official FileUpload plugin is vulnerable to CSRF. A successful attack allows the removal of files the attacked user has the permission to delete. Administrators for example have the permission to delete all attached files. As the request t...

Sanitize-html Cross-Site Scripting Vulnerability

Sanitize-html is a tool for cleaning up user-submitted HTML. A cross-site scripting vulnerability exists in Sanitize-html 1.11.1 and earlier versions. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via nonTextTags...