852 matches found
CSRF Vulnerability in rails-ujs
There is an vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains. Versions Affected: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ This is a regression of CVE-2015-1840. In the scenario where an attacker might be able to control the href attribute of an anchor ta...
Cross-Site Scripting (XSS)
anchorcms/anchor-cms is vulnerable to cross-site scripting XSS. A user with a privilege to login as administrator is allowed to post arbitrary script via the post creation feature which will execute in a user's browser when visited...
CVE-2020-12071
Anchor 0.12.7 allows admins to cause XSS via crafted post content...
Design/Logic Flaw
Anchor 0.12.7 allows admins to cause XSS via crafted post content...
CVE-2020-12071
Anchor 0.12.7 allows admins to cause XSS via crafted post content...
CVE-2020-12071
Anchor CMS 0.12.7 is affected by an XSS vulnerability that allows an admin (privileged user) to inject crafted post content, triggering script execution in other users’ browsers. The issue is described across multiple sources as a cross-site scripting flaw stemming from the post creation feature;...
Anchor Cross-Site Scripting Vulnerability
Anchor is an open source lightweight blogging system. A cross-site scripting vulnerability exists in Anchor version 0.12.7. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...
Node.js third-party modules: [flsaba] Stored XSS in the file and directory name when directories listing
I would like to report a Stored XSS in module "flsaba". It allows to inject malicious scripts in the file and directory name, store them on the server, then execute these scripts in the browser via the XSS vulnerability. Module module name: https://www.npmjs.com/package/flsaba version: 1.1.0 npm...
CentOS 7 : bind (RHSA-2020:1061)
The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1061 advisory. - managed-keys is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in...
bind security update
CentOS Errata and Security Advisory CESA-2020:1061 An update for bind is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
FIN6 and TrickBot Combine Forces in 'Anchor' Attacks
Researchers say, two cybercriminal groups, FIN6 and the operators of the TrickBot malware, have paired up together to target several organizations with TrickBot’s malware framework called “Anchor.” The two threat groups joining forces is a “new and dangerous twist” in an existing trend of...
RHEL 7 : bind (RHSA-2020:1061)
"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1061 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named C...
Moderate: Red Hat Security Advisory: bind security and bug fix update
An update for bind is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
bind: An assertion failure if a trust anchor rolls over to an unsupported key algorithm when using managed-keys
An assertion failure was found in the way bind implemented the "managed keys" feature. An attacker could use this flaw to cause the named daemon to crash. This flaw is very difficult for an attacker to trigger because it requires an operator to have BIND configured to use a trust anchor managed b...
Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2019-2557)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
TrickBot Adds Custom, Stealthy Backdoor to its Arsenal
The Russian-speaking cybercriminals behind the TrickBot malware have developed a stealthy backdoor dubbed “PowerTrick,” in order to infiltrate high-value targets. According to research from SentinelLabs, released on Thursday, PowerTrick is designed to execute commands and return the results in...
Cross-Site Scripting (XSS)
react-autolinker-wrapper is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser as the library does not validate user input and directly render the user provided data when calling the invokeLink method, allowing the conversion o...
Lazarus APT Collaborates with Trickbot's Anchor Project
Researchers have found evidence of a link between global crimeware organization Trickbot and North Korean APT group Lazarus, observing direct collaboration via an all-in-one attack framework developed by Trickbot called Anchor Project. The move appears to be the first time an APT group has aligne...
bind: An assertion failure if a trust anchor rolls over to an unsupported key algorithm when using managed-keys
An assertion failure was found in the way bind implemented the "managed keys" feature. An attacker could use this flaw to cause the named daemon to crash. This flaw is very difficult for an attacker to trigger because it requires an operator to have BIND configured to use a trust anchor managed b...