Security Bulletin: A security bypass vulnerability in Apache Solr (lucene) affects IBM InfoSphere Information Server

Summary A security bypass vulnerability in Apache Solr lucene used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID: CVE-2020-13957 DESCRIPTION: Apache Solr could allow a remote attacker to bypass security restrictions, caused by improper access control by the...

Tenda AC18 Remote Code Execution Vulnerability

Ac18 is a wireless router from Tenda. A remote code execution vulnerability exists in the Tenda AC18. The vulnerability stems from incorrect authentication handling of the logincheck function in the /usr/lib/lua/ngxauthserver/ngxwdas.lua file when the administrator UI is set to "radius". An...

CVE-2020-15831

JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI...

CVE-2019-19118

CVE-2019-19118 affects Django Framework: versions 2.1 before 2.1.15 and 2.2 before 2.2.8. The issue arises in the admin inline editing UI: if a user has view permissions on a parent model but edit permissions on the inline model, the UI could allow POST requests to update the inline model, while ...

Node.js third-party modules: Stored XSS (Hexo-admin plugin)

I would like to report Stored XSS in Hexo-admin It allows The Post editor functionality in the hexo-admin plugin 3.9.0 for Node.js is vulnerable to stored XSS via the content of a post. Module module name: Hexo-admin version: 3.9.0 npm page: https://www.npmjs.com/package/hexo-admin Module...

CVE-2018-10948

The vulnerability CVE-2018-10948 affects Synacor Zimbra Collaboration Suite’s Admin UI (Zimbra Admin UI) in versions before 8.8.0 beta 2, where a Persistent XSS exists via mail addrs. The connected Red Hat/NVD entries confirm the issue is a stored XSS in the Admin UI affected component, but the a...

PT-2019-8774

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions prior to 8.8.0 beta 2 Description The issue is related to a Persistent XSS vulnerability via mail addresses in the Synacor Zimbra Admin UI. Recommendations For versions prior to 8.8.0 beta 2, update to versi...

CVE-2018-10948: Improper Neutralization of Input During Web Page Generation

Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs...

CVE-2019-12139

An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4...

CVE-2019-12139

An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4...

Cross site scripting

An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4...

CVE-2019-12139

CVE-2019-12139 describes a cross-site scripting (XSS) vulnerability in the Admin UI of eZ Platform 2.x. Affected components include ezplatform-admin-ui (1.3.x before 1.3.5; 1.4.x before 1.4.4) and ezplatform-page-builder (1.1.x before 1.1.5; 1.2.x before 1.2.4). The issue is caused by improper es...

CVE-2019-12139

An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4...

eZ Platform Admin UI Cross-Site Scripting Vulnerability

eZ Platform is an open source enterprise content management system CMS. admin UI is one of the back-end management interface . A cross-site scripting vulnerability exists in the Admin UI in eZ Platform version 2.x, which can be exploited by an attacker to execute client-side code...

CVE-2019-12139: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4...

EZSA-2019-001 XSS in Admin UI

More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-001-xss-in-admin-ui...

Cross-site Scripting (XSS)

github.com/fabiolb/fabio is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the value of path and val in admin/ui/manual.go are not sanitized and can be used to inject arbitary Javascript into a victim's browser...

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username...

KeystoneJS 4.0.0-beta.5 Unauthenticated CSV Injection Vulnerability

KeystoneJS version 4.0.0-beta.5 suffers from an unauthenticated CSV injection vulnerability in admin/server/api/download.js and lib/list/getCSVData.js Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated CSV Injection Vendor Homepage: http://keystonejs.com/ Exploit Author: Ishaq Mohammed Contac...

ForgeRock OpenIDM Admin UI Cross-Site Scripting Vulnerability (CNVD-2017-30829)

ForgeRock OpenIDM is an extensible set of identity management tools for managing identity lifecycle and provisioning issues. A cross-site scripting vulnerability in the ForgeRock OpenIDM Admin UI allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which c...