OPENSUSE-SU-2019:1997-1 Security update for neovim

This update for neovim fixes the following issues: neovim was updated to version 0.3.7: CVE-2019-12735: source should check sandbox boo1137443 genappimage.sh: migrate to linuxdeploy Version Update to version 0.3.5: options: properly reset directories on 'autochdir' Remove MSVC optimization...

CVE-2019-4482

IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID...

CVE-2019-4120

IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158146...

PT-2019-17102 · Ibm · Ibm Emptoris Spend Analysis

Name of the Vulnerable Software and Affected Versions: IBM Emptoris Spend Analysis versions 10.1.0 through 10.1.3 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...

Johnson Controls MS-NCE2520-0 Metasys NCE Controller

Binary data 764892.prm...

Johnson Controls MS-NCE2510-0 Metasys NCE Controller

Binary data 764894.prm...

Johnson Controls MS-NCE2526-0 Metasys NCE Controller

Binary data 764891.prm...

Google Discloses 20-Year-Old Unpatched Flaw Affecting All Versions of Windows

Update — With this month's patch Tuesday updates, Microsoft has finally addressed this vulnerability, tracked as CVE-2019-1162, by correcting how the Windows operating system handles calls to Advanced Local Procedure Call ALPC. A Google security researcher has just disclosed details of a...

Down the Rabbit-Hole...

Posted by Tavis Ormandy, Security Research Over-Engineer. “Sometimes, hacking is just someone spending more time on something than anyone else might reasonably expect.”1 I often find it valuable to write simple test cases confirming things work the way I think they do. Sometimes I can’t explain t...

KLA11534 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to obtain sensitive information, execute arbitrary code, gain privileges, cause denial of service, spoof user interface, bypass security restrictions. Below is a complete list of...

CVE-2019-1949 Cisco Firepower Management Center Persistent Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficien...

CVE-2016-10781

cPanel before 60.0.25 allows self XSS in the UIconfirm API SEC-180...

CVE-2019-7000

A Cross-Site Scripting XSS vulnerability in the Web UI of Avaya Aura Conferencing may allow code execution and potentially disclose sensitive information. Affected versions of Avaya Aura Conferencing include all 8.x versions prior to 8.0 SP14 8.0.14. Prior versions not listed were not evaluated...

Xssizer - The Best Tool To Find And Prove XSS Flaws

According to WikiPedia Cross-site scripting is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access...

PT-2019-18407 · Avaya · Avaya Aura Conferencing

Name of the Vulnerable Software and Affected Versions: Avaya Aura Conferencing versions prior to 8.0 SP14 8.0.14 Description: A Cross-Site Scripting XSS issue in the Web UI of Avaya Aura Conferencing may allow code execution and potentially disclose sensitive information. Recommendations: For Ava...

CVE-2019-14411

cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI SEC-473...

Fedora Update for dtkwidget FEDORA-2019-3d418f349c

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

The vulnerability of the User Interface sub-component of the Oracle Advanced Outbound Telephony component in the Oracle E-Business Suite allows a perpetrator to access, modify, add, or delete data.

The vulnerability of the User Interface sub-component of the Oracle Advanced Outbound Telephony component in the Oracle E-Business Suite automation system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to...

Security Bulletin: Spoofing and denial of service vulnerabilities in WebSphere Application Server Liberty affect IBM Spectrum Protect Client web user interface and IBM Spectrum Protect for Virtual Environments (CVE-2018-1902, CVE-2019-4046)

Summary Potential spoofing and denial of service vulnerabilities in IBM WebSphere Application Server Liberty affect IBM Spectrum Protect formerly Tivoli Storage Manager Backup-Archive Client web user interface and IBM Spectrum Protect formerly Tivoli Storage Manager for Virtual Environments...

CVE-2019-2857

Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM subcomponent: UIF Open UI. Supported versions that are affected are 19.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel UI Framework. Successful...