Cross site scripting

The TIBCO Administrator server component of of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains multiple vulnerabilities wherein a malicious user could theoretically perform cross-site scripting XSS attacks by way of...

CVE-2018-5433

The TIBCO Administrator server component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion XXE attacks to disclose host machine...

CVE-2018-5434 XML eXternal Entity Expansion Vulnerabilities with TIBCO Runtime Agent

The TIBCO Designer component of TIBCO Software Inc.'s TIBCO Runtime Agent, and TIBCO Runtime Agent for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion XXE attacks to disclose host machine information. Affected releases are TIBCO Software Inc.'...

CVE-2018-5432

The CVE-2018-5432 issue affects TIBCO Administrator - Enterprise Edition and TIBCO Administrator - Enterprise Edition for z/Linux. A cross-site scripting (XSS) vulnerability exists in the TIBCO Administrator server component, exploitable via manipulation of artifacts prior to uploading. Affected ...

CVE-2018-5432 TIBCO Administrator - Enterprise Edition Cross-Site Scripting Vulnerability

The TIBCO Administrator server component of of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains multiple vulnerabilities wherein a malicious user could theoretically perform cross-site scripting XSS attacks by way of...

CVE-2018-5434

The CVE-2018-5434 issue affects TIBCO Runtime Agent (including TIBCO Designer) and the TIBCO Runtime Agent for z/Linux. The root cause is XML external entity (XXE) expansion, allowing a malicious user to disclose host machine information. Affected releases include TIBCO Runtime Agent up to 5.10.0...

CVE-2018-5433

CVE-2018-5433 describes an XML External Entity (XXE) vulnerability in the TIBCO Administrator server component of the Enterprise Edition and its z/Linux variant. Affected releases are: TIBCO Administrator - Enterprise Edition up to 5.10.0, and TIBCO Administrator - Enterprise Edition for z/Linux ...

TIBCO Security Advisory: June 12, 2018 - TIBCO Runtime Agent -2018-5434

XML eXternal Entity Expansion Vulnerabilities with TIBCO Runtime Agent Original release date: June 12,2018 Last revised: -- CVE-2018-5434 Source: TIBCO Software Inc. XML eXternal Entity Expansion Vulnerabilities with TIBCO Runtime Agent Original release date: June 12, 2018 Last revised: -- Source...

TIBCO Security Advisory: June 12, 2018 - TIBCO Administrator - Enterprise Edition -2018-5433

XML eXternal Entity Expansion Vulnerabilities with TIBCO Administrator Original release date: June 12, 2018 Last revised: -- CVE-2018-5433 Source: TIBCOSoftware Inc. XML eXternal Entity Expansion Vulnerabilities with TIBCO Administrator Original release date: June 12, 2018 Last revised: -- Source...

TIBCO Security Advisory: June 12, 2018 - TIBCO Administrator - Enterprise Edition -2018-5432

TIBCO Administrator - Enterprise Edition Cross-Site Scripting Vulnerability Original release date: June 12,2018 Last revised: -- CVE-2018-5432 Source: TIBCO Software Inc. TIBCO Administrator - Enterprise Edition Cross-Site Scripting Vulnerability Original release date: June 12, 2018 Last revised:...

A week in security (May 28 – June 3)

Last week on Labs, we talked about the significance of SEO poisoning in the world of search marketing, blackmail attempts against financial institutions in Canada, voice command flaws in smart assistants, survey and potential phishing scams on Instagram, and the latest changes in Office 365. We...

Millions of IoT Devices Vulnerable to Z-Wave Downgrade Attacks, Researchers Claim

The popular home automation protocol Z-Wave, used by millions of IoT devices, is vulnerable to a downgrade attack that could allow an adversary to take control of targeted devices, according to researchers. Z-Wave is a wireless protocol used by 2,400 vendors; its wireless chipsets are embedded in...

Z-Wave Downgrade Attack Left Over 100 Million IoT Devices Open to Hackers

Researchers have found that even after having an advanced encryption scheme in place, more than 100 million Internet-of-Things IoT devices from thousands of vendors are vulnerable to a downgrade attack that could allow attackers to gain unauthorized access to your devices. The issue resides in th...

Z-Wave Downgrade Attack Left Over 100 Million IoT Devices Open to Hackers

Researchers have found that even after having an advanced encryption scheme in place, more than 100 million Internet-of-Things IoT devices from thousands of vendors are vulnerable to a downgrade attack that could allow attackers to gain unauthorized access to your devices. The issue resides in th...

z-7.ch XSS vulnerability

Open Bug Bounty ID: OBB-621154 Description| Value ---|--- Affected Website:| z-7.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Z-Shave. Exploiting Z-Wave downgrade attacks

TL;DR: Stronger S2 Z-Wave pairing security process can be downgraded to weak S0, exposing smart devices to compromise. Z-Wave uses a shared network key to secure traffic. This key is exchanged between the controller and the client devices ‘nodes’ when the devices are paired. The keys are used to...

qemu-kvm security update

0.12.1.2-2.503.el69.6 - qemu-kvm-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch bz1574067 - Resolves: bz1574067 EMBARGOED CVE-2018-3639 qemu-kvm: Kernel: omega-4 rhel-6.9.z...

Z-BlogPHP Cross-Site Scripting Vulnerability (CNVD-2018-09795)

Z-BlogPHP is an open source PHP-based blogging system developed by the Z-Blog community. A cross-site scripting vulnerability exists in Z-BlogPHP version 2.0.0. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML via the 'copyright notice' field...

Z-BlogPHP Security Bypass Vulnerability

Z-BlogPHP is an open source PHP-based blogging system developed by the Z-Blog community. A security vulnerability exists in Z-BlogPHP version 2.0.0. An attacker can exploit the vulnerability to bypass access restrictions...

Design/Logic Flaw

DISPUTED An issue was discovered in Z-BlogPHP 2.0.0. zbsystem/cmd.php?act=verify relies on MD5 for the password parameter, which might make it easier for attackers to bypass intended access restrictions via a dictionary or rainbow-table attack. NOTE: the vendor declined to accept this as a valid...