WordPress Rating-Widget: Star Review System 2.8.9 Information Disclosure

Details ================ Software: Rating-Widget: Star Review System Version: 2.8.9 Homepage: https://wordpress.org/plugins/rating-widget/ Advisory report: https://advisories.dxw.com/advisories/rating-widget-debug-mode/ CVE: Awaiting assignment CVSS: 5 Medium; AV:N/AC:L/Au:N/C:P/I:N/A:N Descripti...

WordPress Rating-Widget: Star Review System 2.8.9 Information Disclosure Vulnerability

WordPress Rating-Widget: Star Review System plugin version 2.8.9 suffers from an information disclosure vulnerability. Details ================ Software: Rating-Widget: Star Review System Version: 2.8.9 Homepage: https://wordpress.org/plugins/rating-widget/ Advisory report:...

VK.com: Reflected XSS в /al_audio.php

XSS в аудио. XSS в прикреплении аудиозаписи в виджете комментариев...

CVE-2018-4168

An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Files Widget" component. It allows physically proximate attackers to obtain sensitive information by leveraging the display of cached data on a locked device...

CVE-2018-4168

An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Files Widget" component. It allows physically proximate attackers to obtain sensitive information by leveraging the display of cached data on a locked device...

Design/Logic Flaw

An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Files Widget" component. It allows physically proximate attackers to obtain sensitive information by leveraging the display of cached data on a locked device...

CVE-2018-4168

An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Files Widget" component. It allows physically proximate attackers to obtain sensitive information by leveraging the display of cached data on a locked device...

CVE-2018-4168

CVE-2018-4168 concerns the Apple iOS Files Widget. Affected: iOS versions prior to 11.3. Issue: the Files Widget could display cached data while the device was locked, enabling a physically proximate attacker with access to the screen to see sensitive information. Root cause (per Apple documentat...

CVE-2018-4168: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Files Widget" component. It allows physically proximate attackers to obtain sensitive information by leveraging the display of cached data on a locked device...

PT-2018-16453

Name of the Vulnerable Software and Affected Versions iOS versions prior to 11.3 Description The issue involves the Files Widget component, allowing physically proximate attackers to obtain sensitive information by leveraging the display of cached data on a locked device. Recommendations For iOS...

Foreman 1.9 < 1.16.1 Multiple Vulnerabilities

Foreman is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:theforeman:foreman"; if description...

CA API Developer Portal Cross-Site Scripting Vulnerability (CNVD-2018-06884)

CA API Developer Portal is a set of CA's API Application Programming Interface query function for software developers. A cross-site scripting vulnerability exists in the widgetID variable in CA API Developer Portal, which stems from the program failing to properly filter user-submitted HTML code....

Apple iOS Files Widget Information Disclosure Vulnerability

Apple iOS is an operating system developed by Apple for mobile devices, and Files Widget is one of the file tool components. A security vulnerability exists in the Files Widget component in Apple iOS versions prior to 11.3, which can be exploited to obtain sensitive information by displaying cach...

CVE-2018-6587

CA API Developer Portal 3.5 up to and including 3.5 CR6 has a reflected cross-site scripting vulnerability related to the widgetID variable...

PT-2018-17651 · Ca · Ca Api Developer Portal

Name of the Vulnerable Software and Affected Versions: CA API Developer Portal versions 3.5 up to and including 3.5 CR6 Description: The issue is related to a reflected cross-site scripting vulnerability. This vulnerability is associated with the widgetID variable. Recommendations: For CA API...

About the security content of iOS 11.3

About the security content of iOS 11.3 This document describes the security content of iOS 11.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recen...

Mail.ru: IDOR widget.support.my.com

На lootdog.io можно обратиться в службу поддержки. Когда мы создали тикет и хотим его подгрузить, то выполняется запрос...

Mail.ru: Shell upload in http://widget.support.my.com/

PHP shell upload was possible on widget.support.my.com support frontend site. This report was accepted within lootdog.io preliminary bug bounty program, because lootdog.io is supported via support.my.com...

Coinbase: Prepopulation of email address and name leaks information provided to other merchants

Users of the commerce widget that have entered their name and email into the widget and moved to the currency selection step were vulnerable to a clickjacking attack that revealed name and email to an attacker due to pre-population of the widget's fields. After a user filled out the name / email...

SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2018:0361-1)

This update for MozillaFirefox to version ESR 52.6 fixes several issues. These security issues were fixed : - CVE-2018-5091: Use-after-free with DTMF timers bsc1077291. - CVE-2018-5095: Integer overflow in Skia library during edge builder allocation bsc1077291. - CVE-2018-5096: Use-after-free whi...