CVE-2018-19301

CVE-2018-19301 affects tp4a TELEPORT 3.1.0 and is an XSS vulnerability: a crafted username mishandled on the login page can be reflected when an administrator later views the system log. Multiple sources (NVD entry, CNVD/CVEs) describe the issue as a cross-site scripting flaw in the login flow, t...

CVE-2018-19301

tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later views the system log...

PT-2018-14911

Name of the Vulnerable Software and Affected Versions TELEPORT version 3.1.0 Description The issue allows for XSS via the login page. This occurs because a crafted username is mishandled when an administrator later views the system log. Recommendations For version 3.1.0, as a temporary workaround...

CVE-2018-19301: Improper Neutralization of Input During Web Page Generation

tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later views the system log...

Cross-site Request Forgery (CSRF)

github.com/gravitational/teleport is vulnerable to cross-site request forgery CSRF. The library does not have any CSRF protection on its API endpoints, allowing a malicious user to hijack the authentication of other users and submit arbitrary requests...

Carbanak Using Google Services for Command and Control

Carbanak certainly has not sat idly by after years of advanced criminal campaigns targeting primarily financial institutions. The outfit, alleged to have stolen from more than 100 banks worldwide, has popped up again with a new means of managing command and control over its malware and implants...