2172 matches found
WordPress Pootle Button 1.1.1 Cross Site Scripting
Class Input Validation Error Remote Yes Reflected Yes Credit Ricardo Sanchez Vulnerable Pootle button plugin 1.1.1 Pootle button plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute...
Cross-site Scripting (XSS) Through SVG Documents
silverstripe/installer and silverstripe/framework are vulnerable to cross-site scripting XSS attacks. These attacks are possible because the Insert Media option within the content editor, and the pathname in admin/assests/add allow attackers to insert SVG documents containing arbitrary javascript...
CVE-2017-14498
SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by 1 the Insert Media option in the content editor or 2 an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017...
Code injection
SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by 1 the Insert Media option in the content editor or 2 an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017...
PYSEC-2017-105
Apache Atlas versions 0.6.0 incubating, 0.7.0 incubating, and 0.7.1 incubating allow access to the webapp directory contents by pointing to URIs like /js and /img...
CEOs Resign from Trump's Cybersecurity Commission
Eight members of the National Infrastructure Advisory Council resigned last week, citing inadequate attention by the Trump Administration to address growing cybersecurity threats facing the United States. President Donald Trump’s Administration has “given insufficient attention to the the growing...
Countdown to GDPR: Manage Vulnerabilities
If your organization needs a compelling reason for establishing or enhancing its vulnerability management program, circle this date in bold, red ink on your corporate calendar: May 25, 2018. On that day, the EU's General Data Protection Regulation GDPR goes into effect, intensifying the need for...
Oracle E-Business Suite 12.x - Server-Side Request Forgery
Exploit Title: Oracle E-Business Suite - Server Side Request Forgery Date: 19 July 2017 Exploit Author: Sarath Nair aka AceNeon13 Contact: @AceNeon13 Greetings: Raj3sh.tv, Deepu.tv Vendor Homepage: www.oracle.com Software Link:...
AlphaBay Shut Down After Police Raid; Alleged Founder Commits Suicide in Jail
AlphaBay Market — one of the largest Dark Web marketplaces for drugs, guns, and other illegal goods — that mysteriously went dark earlier this month without any explanation from its admins has reportedly been shut down by the international authorities. On July 4th, the dark web marketplace sudden...
Visualizing the Stack Clash Vulnerability with Dashboards
Security teams should apply vendor patches immediately to protect their Linux, OpenBSD, NetBSD, FreeBSD and Solaris infrastructure from The Stack Clash vulnerability also see the security advisory. To help in that effort, this blog post describes a new built-in Qualys AssetView dashboard to...
No More Tears: WannaCry Highlights Importance of Prompt Vulnerability Detection, Remediation
It didn’t have to happen. That’s the simple yet profound lesson from WannaCry’s ransomware rampage that has infected 300,000-plus systems in more than 150 countries, disrupting critical operations across industries, including healthcare, government, transportation and finance. If vulnerable syste...
Senate's Use of Signal A Good First Step, Experts Say
On Tuesday the United States Senate made it official and approved the use of encrypted messaging app Signal by staffers. Encryption advocates applauded the measure, but say more needs to be done to protect “civic” infrastructure critical to democracy. “The move to secure communications...
For GDPR Readiness, You Need Visibility into Your IT Assets
The looming deadline for complying with the EU’s General Data Protection Regulation GDPR is shining the spotlight on a foundational InfoSec best practice: A comprehensive IT asset inventory. The reason: GDPR places strict requirements on the way a business handles the personally identifiable...
Cross-origin Resource Sharing (CORS) Globally Enabled By Default
webpack-dev-middleware enables cross-origin resource sharing CORS by default. This allows malicious websites to access assets of a web application...
OSINT Gathering Tool: Inquisitor
OSINT Gathering Tool Inquisitor is a simple for gathering information on companies and organizations through the use of Open Source Intelligence OSINT sources. The key features of Inquisitor include: 1. The ability to cascade the ownership label of an asset e.g. if a Registrant Name is known to...
The vulnerability of the Mac OS X operating system allows attackers to increase their privileges and alter the loaded mobile activities.
The vulnerability of the Mac OS X operating system’s Assets component is related to deficiencies in access control. Exploiting this vulnerability allows an attacker acting locally to enhance their privileges and modify the loaded mobile activity using uncertain vectors...
Design/Logic Flaw
An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "Assets" component, which allows local users to bypass intended permission restrictions and change a downloaded mobile asset via unspecified vectors...
CVE-2016-7628
An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "Assets" component, which allows local users to bypass intended permission restrictions and change a downloaded mobile asset via unspecified vectors...
Legal Robot: Legal Robot AWS S3 Bucket Directory Listing
A security researcher found an AWS S3 bucket serving public resources intentionally. The files in this bucket were static assets like logos and marketing assets. We later removed this bucket altogether and therefore re-opened and marked this report as Resolved...
