CVE-2018-1211

CVE-2018-1211 affects Dell EMC iDRAC7/iDRAC8, prior to firmware 2.52.52.52. A path traversal flaw in the iDRAC Web server URI parser allows an unauthenticated remote attacker to read sensitive configuration data by querying crafted URI strings. Impact is partial confidentiality compromise; no int...

Authorization

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations...

CVE-2018-8899

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations...

CVE-2018-8899

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations...

CVE-2018-8899

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations...

CVE-2014-3626

The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did no...

Directory traversal

The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did no...

Microsoft Windows Remote Assistance XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Information disclosure

The Mail.ru Calendar plugin before 2.5.0.61 for Atlassian Jira has XSS via the Name field in a Create Calender action, related to a MailRuCalendar.jspaperiod/month URI...

Design/Logic Flaw

server/app/views/static/code.html in Kontena before 1.5.0 allows XSS in "kontena master login --remote" code display, as demonstrated by /codecode= in a URI...

Adobe Connect Arbitrary File Deletion Vulnerability

Adobe Connect web conferencing software service provides an immersive online meeting experience for collaboration, virtual classrooms and large-scale webinars. An arbitrary file deletion vulnerability exists in Adobe Connect due to a command injection flaw in the Adobe Connect URI handler that ca...

Adobe Dreamweaver Arbitrary Code Execution Vulnerability

Adobe Dreamweaver, or "DW" for short, is a WYSIWYG web code editor that combines web authoring and web site management, using a WYSIWYG interface with HTML an application of the Standard Generalized Markup Language editing. Adobe Dreamweaver makes it easy to create, code, and manage dynamic Web...

APSB18-06 Security update available for Adobe Connect

Adobe has released a security update for Adobe Connect. This update resolves an unrestricted SWF file upload vulnerability CVE-2018-4921, which could be exploited to conduct cross-site scripting attacks. This update also resolves an OS command injection vulnerability in the Adobe Connect URI...

undertow: Client can use bogus uri in Digest authentication

It was discovered that when using Digest authentication, the server does not ensure that the value of the URI in the authorization header matches the URI in the HTTP request line. This allows the attacker to execute a MITM attack and access the desired content on the server...

undertow: Client can use bogus uri in Digest authentication

It was discovered that when using Digest authentication, the server does not ensure that the value of the URI in the authorization header matches the URI in the HTTP request line. This allows the attacker to execute a MITM attack and access the desired content on the server...

CVE-2018-8070

QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI...

CVE-2018-8069

QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI...

CVE-2018-8069

QCMS 3.0 is affected by a cross-site scripting vulnerability: an attacker can inject arbitrary script via the webname parameter in the /backend/system.html URI. The issue is reported across multiple sources (NVD CVE-2018-8069 and Red Hat/CNVD entries). The root cause is improper handling/encoding...

CVE-2018-8070

QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI...

Fixed in Apache Tomcat JK Connector 1.2.43

Important: Information disclosure CVE-2018-1323 The IIS/ISAPI specific code that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible for a...