Security Bulletin: IBM Streams is potentially affected by a vulnerability caused by parsing text in the Web Console

Summary The IBM Streams Web console is potentially vulnerable to cross-site scripting and other related attacks. IBM Streams has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-1431 DESCRIPTION: IBM InfoSphere Streams is vulnerable to cross-site scripting. This vulnerability...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Data Studio Web Console. (CVE-2014-6593, CVE-2015-0410)

Summary There are multiple vulnerabilities in IBMｮ Runtime Environments JavaTechnology Edition, Version 5, 6 and 7 that is used by IBM Data Studio Web Console DSWC. These issues were disclosed as part of the IBM Java SDK updates in January 2015. Vulnerability Details CVE-ID: CVE-2014-6593...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Data Studio Web Console. (CVE-2014-6457, CVE-2014-3065)

Summary There are multiple vulnerabilities in IBM® Runtime Environments Java™ Technology Edition, Versions 5, 6 and 7, which are used by IBM Data Studio Web Console DSWC. These issues were disclosed as part of the IBM Java SDK updates in October 2014. Vulnerability Details CVE-ID: CVE-2014-3065...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Data Studio Web Console. (CVE-2014-4263)

Summary There are multiple vulnerabilities in IBM® Runtime Environments Java™ Technology Edition, Versions 6 and 7, which affect IBM Data Studio Web Console DSWC. These issues were disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details CVEID: CVE-2014-4263 DESCRIPTION: ...

CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

Code injection

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

CVE-2018-5167

The CVE-2018-5167 issue affects Mozilla Firefox prior to version 60, where the web console and JavaScript debugger fail to sanitize all hyperlink-output. This can cause chrome: and javascript: links to render as active hyperlinks, enabling potential user interaction with internal pages via malici...

Mozilla Firefox Design Vulnerability (CNVD-2018-11791)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 60, which stems from a failure of the web console and JavaScript debugger to filter all output with hyperlinks. A remote...

CVE-2016-10532

console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running...

CVE-2016-10532

The CVE-2016-10532 issue concerns the console-io module, specifically versions 2.2.13 and earlier, where socket.io is not configured to require authentication. This allows an attacker to connect via WebSocket, bypass authentication, and execute commands with the same privileges as the console-io ...

Quest KACE System Management Appliance 8.0 (Build 8.0.318) XSS / Traversal / Code Execution / SQL Injection

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Quest KACE System Management Appliance Multiple Vulnerabilities 1. Advisory Information Title: Quest KACE System Management Appliance Multiple Vulnerabilities Advisory ID: CORE-2018-0004 Advisory URL:...

ovirt-engine: account enumeration through login to web console

The ovirt-engine web console login form returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts...

CVE-2018-1073

The ovirt-engine web console login form returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts...

UBUNTU-CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

Exploit for Improper Access Control in Rubyonrails Web_Console

No d...

Cross site scripting

Floodlight version 1.2 and earlier contains a Cross Site Scripting XSS vulnerability in the web console that can result in javascript injections into the web page. This attack appears to be exploitable via the victim browsing the web console...