731 matches found
CVE-2021-22814: Improper Neutralization of Input During Web Page Generation
A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists which could cause arbritrary script execution when a malicious file is read and displayed. Affected Products: 1-Phase Uninterruptible Power Supply UPS using NMC2 including Smart-UPS,...
PT-2022-9285 · Apc · Apc Rack Power Distribution Units +19
Name of the Vulnerable Software and Affected Versions: APC Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 NMC2 versions 6.9.8 and earlier APC Symmetra PX 250/500 SYPX Network Management Card 2 NMC2 versions 6.9.6 and earlier APC Symmetra PX 48/96/100/160 kW UPS PX2, Symmetra ...
CVE-2021-22812: Improper Neutralization of Input During Web Page Generation
A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC. Affected Products: 1-Phase Uninterruptible Power...
PT-2022-9281
Name of the Vulnerable Software and Affected Versions APC Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 NMC2 versions prior to NMC2 AOS V6.9.8 APC Symmetra PX 250/500 SYPX Network Management Card 2 NMC2 versions prior to NMC2 AOS V6.9.6 APC Symmetra PX 48/96/100/160 kW UPS...
PT-2022-9282
Name of the Vulnerable Software and Affected Versions APC Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 NMC2 versions 6.9.8 and earlier APC Symmetra PX 250/500 SYPX Network Management Card 2 NMC2 versions 6.9.6 and earlier APC Symmetra PX 48/96/100/160 kW UPS PX2, Symmetra P...
CVE-2021-44201
Cross-site scripting XSS was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 Windows, Linux before build 28035...
Cross site scripting
Cross-site scripting XSS was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 Windows, Linux before build 28035...
CVE-2021-44201 Cross-site scripting (XSS) was possible in notification pop-ups
Cross-site scripting XSS was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 Windows, Linux before build 28035...
CVE-2021-44201
CVE-2021-44201 affects Acronis Cyber Protect 15 (Windows, Linux) before build 28035. The vulnerability is a cross-site scripting (XSS) in notification pop-ups caused by failing to validate user input data, enabling potential client-side code execution. Per the connected records, the issue is netw...
CVE-2021-44201: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 Windows, Linux before build 28035...
PT-2021-24062
Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect 15 versions prior to build 28035 Description: A cross-site scripting XSS issue was possible in notification pop-ups. This allowed for potential malicious script execution. The estimated number of potentially affected...
Cross-site scripting (XSS) was possible in notification pop-ups
...
Schneider Electric NMC cards and Embedded Devices
1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Network Management Cards NMC and NMC Embedded Devices Vulnerabilities: Cross-site Scripting, Exposure of Sensitive Information to an Unauthorized Actor 2. RISK EVALUATION...
Ad-blocker Chrome extension AllBlock injected ads in Google searches
By Deeba Ahmed AllBlock was available on Google Chrome's Web Store where it is marketed as a potent Ad Blocker focusing on Facebook and YouTube to prevent pop-ups. This is a post from HackRead.com Read the original post: Ad-blocker Chrome extension AllBlock injected ads in Google searches...
CVE-2021-41109 LiveQuery publishes user session tokens
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscriptio...
A week in security (Sept 13 – Sept 19)
Last week on Malwarebytes Labs Why backups aren’t a “silver bullet” against ransomware, with Matt Crape: Lock and Code S02E17 The many tentacles of Magecart Group 8 Apple releases emergency update: Patch, but don’t panic Update now! Google Chrome fixes two in-the-wild zero-days Parts of the Dark...
An Introduction to the Specifics of Start-Ups Security
Security probably would not be too interesting to you at all if you were a liquor store, restaurant, or work in similar sectors of the economy. However, security should definitely be a front-row concept if you are a start-up in the technology space or a business that depends on technology for...
CVE-2021-27620
SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method Ups::AddPart which will trigger an...
CVE-2021-27620: Out-of-bounds Write
SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method Ups::AddPart which will trigger an...
