SUSE-SU-2020:1958-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: - Mozilla Firefox 78.0.2 MFSA 2020-28 bsc1173948 MFSA-2020-0003 bmo1644076 X-Frame-Options bypass using object or embed tags - Firefox Extended Support Release 78.0.2esr ESR Fixed: Security fix Fixed: Fixed an accessibility regression in...

CVE-2020-9311: Malicious user profile information can cause login form XSS

More info at https://www.silverstripe.org/download/security-releases/cve-2020-9311/...

Skype for Business via Internet Explorer Information Disclosure Vulnerability

An information disclosure vulnerability exists when Skype for Business is accessed via Internet Explorer. An attacker who exploited the vulnerability could cause the user to place a call without additional consent, leading to information disclosure of the user profile. For the vulnerability to be...

Fedora 32 : seamonkey (2020-7e974bd2bb)

Update to 2.53.3 The database format of the stored passwords and certificates in the user profile are now changed. SeaMonkey should perform the changes hiddenly at the first run, just asking for the master password if used. To avoid a hypothetical data loss, it is recommended to backup user profi...

Fedora 31 : seamonkey (2020-0fc1639c88)

Update to 2.53.3 The database format of the stored passwords and certificates in the user profile are now changed. SeaMonkey should perform the changes hiddenly at the first run, just asking for the master password if used. To avoid a hypothetical data loss, it is recommended to backup user profi...

JobSearch < 1.5.3 - Multiple Cross-Site Scripting Issues

An Unauthenticated Reflected & Multiple Authenticated Persistent XSS vulnerabilities was discovered in the JobSearch plugin through 1.5.1 and 1.5.2 for WordPress. Authenticated Persistent XSS on the Candidate and Employer Profile pages. An Authenticated Persistent XSS @ Job Page will trigger on t...

Cross site scripting

An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail signature...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Missing Permission Check on Time Tracking Cross-Site Scripting in PyPi Files API Insecure Authorization Check on Private Project Security Dashboard Cross-Site Scripting in References Cross-Site Scripting in Group Names Cross-Site Scripting in Blob Viewer Cross-Site Scripting in...

BSA Radar 1.6.7234.24750 Cross Site Scripting

Exploit title: BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting Exploit Author: William Summerhill Date: 2020-06-22 Vendor homepage: https://www.globalradar.com/ Tested on: Window CVE-2020-14943 Description: The "Firstname" and "Lastname" parameters in Global RADAR BSA Radar 1.6.7234.X...

Cross-Site Request Forgery (CSRF)

nukeviet/nukeviet is vulnerable to cross site request forgery CSRF. The vulnerability exists as the application is not able to verify the authenticity of requests. An attacker is able to exploit the vulnerability and submit requests on behalf of the user to change profile details and password of...

BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting

Exploit title: BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting Exploit Author: William Summerhill Date: 2020-06-22 Vendor homepage: https://www.globalradar.com/ Tested on: Window CVE-2020-14943 Description: The "Firstname" and "Lastname" parameters in Global RADAR BSA Radar 1.6.7234.X...

CVE-2020-14943

The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting XSS via Update User Profile...

Cross site scripting

The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting XSS via Update User Profile...

CVE-2020-14943

CVE-2020-14943 affects Global RADAR BSA Radar versions 1.6.7234.24750 and earlier. The vulnerability is a stored cross-site scripting (XSS) in the Update User Profile feature, exploitable via the Firstname and Lastname parameters. Public PoCs and exploits show injection of script payloads (e.g., ...

PT-2020-14079 · Global Radar · Global Radar Bsa Radar

Name of the Vulnerable Software and Affected Versions: Global RADAR BSA Radar versions 1.6.7234.24750 and earlier Description: The issue concerns stored cross-site scripting XSS via the Update User Profile feature. Specifically, the Firstname and Lastname parameters are vulnerable. Recommendation...

CVE-2020-12712

SOS JobScheduler JOE component (versions 1.12 and 1.13) stores FTP/SSH passwords using the profile name as the encryption key, enabling decryption of the plaintext password due to insecure encryption. Impact: attackers who can access the profile configuration can recover stored credentials. Root ...

CVE-2020-0116

In checkSystemLocationAccess of LocationAccessPolicy.java, there is a possible bypass of user profile isolation due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2020-0116

In checkSystemLocationAccess of LocationAccessPolicy.java, there is a possible bypass of user profile isolation due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Design/Logic Flaw

In checkSystemLocationAccess of LocationAccessPolicy.java, there is a possible bypass of user profile isolation due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

XSS Vulnerability in jfinal cms User Profile Edit

jfinal cms is a java development of powerful information consulting website , using a simple and powerful JFinal as the web framework , template engine with beetl, database with mysql, front-end bootstrap framework. jfinal cms user profile editing XSS vulnerability , an attacker can exploit the...