Apple iOS Messages UI Spoofing Vulnerability (CNVD-2018-26504)

Apple iOS is an operating system for mobile devices developed by Apple Inc. Messages is a component of the application used to send text, photos and videos. A security vulnerability exists in the Messages component in Apple iOS versions prior to 12.1. The vulnerability can be exploited by an...

Apple macOS Mojave Mail UI Spoofing Vulnerability

Apple macOS Mojave is a specialized operating system developed by Apple Inc. for Mac computers.The App Store is a platform for online distribution of applications.Mail is an email component of the... A security vulnerability exists in the Mail component of Apple macOS Mojave version 10.14. The...

CVE-2018-9524

In functionality implemented in System UI, there are insufficient protections implemented around overlay windows. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0...

CVE-2018-17476

Incorrect dialog placement in Cast UI in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page...

KLA11351 Multiple vulnerabilities in Microsoft Dynamics

Multiple serious vulnerabilities were found in Microsoft Dynamics. Malicious users can exploit these vulnerabilities to spoof user interface, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Multiple cross site scripting vulnerabilities in Microsoft Dynamics 365 on-premises...

The vulnerability of the Omnibox component in the Chrome web browser allows a hacker to replace the URI address.

The vulnerability of the Omnibox component in the Chrome web browser is related to information representation errors in the user interface. Exploiting this vulnerability could allow a malicious actor to substitute the displayed URI address...

KLA11352 SUI vulnerability in Adobe Flash Player

Out-of-bounds read vulnerability was found in Adobe Flash Player. Malicious users can exploit this vulnerability to spoof user interface. Technical details To update Adobe Flash Player ActiveX detected as Flash.ocx on Windows 8 and higher, install latest updates from Control Panel Original...

KLA11898 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products ESU. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, gain privileges, spoof user interface, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A memory...

The vulnerability of the Omnibox component in the Chrome web browser allows a hacker to replace the URI address.

The vulnerability of the Omnibox component in the Chrome web browser is related to information representation errors in the user interface. Exploiting this vulnerability could allow an attacker to replace the displayed URI address...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability (CNVD-2018-23091)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A cross-site...

CVE-2018-1872

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 151330...

Cisco Prime Collaboration Assurance Arbitrary File Overwrite Vulnerability

Cisco Prime Collaboration Assurance PCA is the United States Cisco Cisco a set of enterprise collaboration network management solutions. The program supports a unified management console to simplify the management of unified communications and video collaboration network, as well as rapid...

CVE-2018-15393 Cisco Content Security Management Appliance (SMA) Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Content Security Management Appliance SMA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface. The vulnerability is due to...

Kaspersky: Kaspersky Password Manager is vulnerable to HTML injection in the browser action pop-up via user name

Note: According to https://www.securityweek.com/kaspersky-adds-password-manager-bug-bounty-program and some other sources, Kaspersky Password Manager is in scope for this program. The program description doesn't reflect this however. Summary There is a stored XSS vulnerability in popover.html the...

WordPress 4.4.x < 4.4.7 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the class-wp-press-this.php script due to a failure to properly restrict the user interface for assigning taxonomy terms...

WordPress 4.2.x < 4.2.12 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the class-wp-press-this.php script due to a failure to properly restrict the user interface for assigning taxonomy terms...

[SECURITY] [DSA 4330-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4330-1 [email protected] https://www.debian.org/security/ Michael Gilbert November 02, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4330-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4330-1 [email protected] https://www.debian.org/security/ Michael Gilbert November 02, 2018 https://www.debian.org/security/faq -...

CVE-2018-1766

IBM Team Concert RTC 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IB...

IBM Rational Team Concert and Rational Collaborative Lifecycle Management Cross-Site Scripting Vulnerability

IBM Rational Team Concert RTC and Rational Collaborative Lifecycle Management CLM are both collaborative lifecycle management solutions from IBM USA. A cross-site scripting vulnerability exists in IBM RTC and Rational CLM. A remote attacker can exploit this vulnerability to inject arbitrary...