6722 matches found
Cross site scripting
The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability issue attachments with a mixed multipart...
CVE-2020-4025
The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Sit...
CVE-2020-4022
CVE-2020-4022 affects Atlassian Jira Server and Data Center: the attachment download resource and issue attachments component allow remote attackers to inject arbitrary HTML or JavaScript via XSS when handling mixed multipart content types. Affected versions include Jira Server/Data Center before...
Unspecified vulnerability in MISP (CNVD-2020-51414)
MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP version 2.4.128, which stems from insufficient ACL...
CVE-2020-15411
An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader...
CVE-2020-15411
An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader...
Design/Logic Flaw
An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader...
CVE-2020-15411
An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader...
CVE-2020-5582
Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to alter the data for the file attached to Report via unspecified vectors...
CVE-2020-5582
Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to alter the data for the file attached to Report via unspecified vectors...
Multiple vulnerabilities in Cybozu Garoon
Overview Cybozu, Inc. has released security updates for Cybozu Garoon. CyVDB-2083 Vulnerability in Single sign-on settings to avoid viewing and operation privileges - CVE-2020-5580 CyVDB-2451 Path traversal vulnerability on the portal - CVE-2020-5581 CyVDB-2097 Vulnerability to bypass operation...
Cybozu Garoon Bypass Attachment Operation Privilege Vulnerability
Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A security vulnerability exists in Cybozu Garoon versions 4.0.0 through 5.0.1. A remote attacker can exploit the...
Fedora 32 : roundcubemail (2020-aeffd92b77)
RELEASE 1.4.6 - Installer: Fix regression in SMTP test section 7417 ---- RELEASE 1.4.5 - Fix bug in extracting required plugins from composer.json that led to spurious error in log 7364 - Fix so the database setup description is compatible with MySQL 8 7340 - Markasjunk: Fix regression in jsevent...
CVE-2017-18880
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the titlelink field of a Slack attachment...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the titlelink field of a Slack attachment...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the authorlink field of a Slack attachment...
CVE-2017-18880
Mattermost Server vulnerable to cross-site scripting (XSS) via the title_link field of a Slack attachment in versions prior to 4.3.0, 4.2.1, and 4.1.2. Connected documents confirm the same description; no exploitation details or fixes are provided in the available sources. Action: monitor for upd...
CVE-2017-18879
Mattermost Server is affected by an XSS vulnerability via the author_link field in Slack attachments. Exploitation targets versions before 4.3.0, 4.2.1, and 4.1.2. Root cause: improper handling of Slack attachment author_link content leading to script execution. Remediation: upgrade to Mattermost...