865 matches found
CVE-2015-5060
Cross-site scripting XSS vulnerability in anchor-cms before 0.9-dev...
CVE-2015-5060
Cross-site scripting XSS vulnerability in anchor-cms before 0.9-dev...
CVE-2015-5060
CVE-2015-5060 is an XSS vulnerability in anchor-cms prior to version 0.9-dev. The CNVD entry confirms the issue affects anchor-cms with an open XSS flaw that allows a remote attacker to inject arbitrary script/HTML. The NVD record reiterates the vulnerability as a cross-site scripting flaw in anc...
"Missing intermediate certificates or root anchor" While Scanning Vulnerablity of MDM IP
While customer uses 3rd-party security scanner to scan MDM IP, there is warning:"Missing intermediate certificates or root anchor"...
Cross-Site Scripting (XSS)
anchorcms/anchor-cms is vulnerable to cross-site scripting XSS attacks. The attacks exists because write function in system/cookie.php does not enforce the HttpOnly header when creating cookies...
Cross-Site Scripting (XSS)
anchorcms/anchor-cms is vulnerable to cross-site scripting XSS attacks. These attacks are possible because the comment output from commenttext is not filtered and encoded properly, allowing a malicious user to inject and execute arbitrary web script through it...
Monero: TabNabbing issue (due to taget=_blank)
Hi team, i get to know in this particular url https://getmonero.org/get-started/what-is-monero/ and i found one 3rd party url. Issue lies Here : Here i can see you are using target=blank and no more rel tag. Here , target=blank means it will open in another new tab. but due to tabnabbing it can...
Cross-Site Scripting (XSS)
anchorcms/anchor-cms is vulnerable to cross-site scripting XSS attacks. The attacks are possible because 404 errors and uncaught exception error are not filtered and encoded properly, allowing a malicious user to inject and execute arbitrary web script through a URI...
CVE-2017-11173
Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...
DEBIAN-CVE-2017-11173
Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...
CVE-2017-11173
Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...
CVE-2017-11173
Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...
UBUNTU-CVE-2017-11173
Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...
bind security and bug fix update
32:9.9.4-50.1 - Bump again above RHEL-7.4 32:9.9.4-38.5 - Fix CVE-2017-3142 and CVE-2017-3143 32:9.9.4-38.4 - Update root servers and trust anchor 1459649...
CVE-2017-8794
An issue was discovered on Accellion FTA devices before FTA912180. Because a regular expression intended to match local https URLs lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwdhttps:// URL pattern...
iOS DEP enrollment may fail when updating the trusted anchor certificates used to trust the SSL connection to the MDM server
After you enable iOS bulk enrollment, the upgrade of the trusted anchor certificates may cause the iOS DEP enrollment or re-enrollment failure. The issue may occur when you change from a self-signed certificate to a public certificate, purchase a certificate from a new provider, or move to an...
Anchor CMS 0.12.1 Cross Site Scripting
======================================================================== | Title : Anchor cms 0.12.1 bundled XSS vulnerability | Author : indoushka | email : [email protected] | Tested on : windows 8.1 FranASSais V.Pro | Version : 5.2.0 | Vendor :...
Dream Job: TV News Anchor Girl - Dangerous filesystem permissions, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Dream Job: TV News Anchor Girl published at the 'play' market has multiple vulnerabilities...
HackerOne: Possible XSS
Hi, I opened this report as soon as I have read https://mathiasbynens.github.io/rel-noopener/ It doesn't necessarly affect HackerOne, nor have i given it enough time to get a working dom manipulation. But since Markdown allows creating target attributes to anchor tags, it may be possible to get...
Ruby on Rails jquery-ujs和jquery-rails安全绕过漏洞
Impact In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to " https://attacker.com" note the leading space that will be passed to JQuery, who...