CVE-2018-8903

Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen...

CVE-2018-8903

Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen...

CVE-2018-8903

Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen...

Cross site scripting

Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen...

CVE-2018-8903

Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen...

CVE-2018-8903

CVE-2018-8903 affects Open-AuditIT/Open‑Audit Professional 2.1. The vulnerability is a stored XSS via the Name or Description fields on the Credentials page, stemming from insufficient input sanitization. Public references in the connected documents confirm exploitation guidance (stored XSS PoC) ...

WhatCMS - CMS Detection And Exploit Kit Based On Whatcms.org API

CMS Detection and Exploit Kit based on Whatcms.org API. Introduction Whatcms.sh can currently detect the use of more than 330 different CMS applications and services to later indicate a list of valid security audit tools for the detected CMS. You need the whatcms.org API to use the tool: Get API...

Takeaways from GAM 2018: Internal Audit Embraces Cybersecurity

Last week, the Institute of Internal Auditors IIA held its 2018 Global Audit Management Conference at the Aria Resort in Las Vegas. With over 1,700 attendees, this was the most well-attended event in the history of the conference. Coalfire was one of the sponsors, and we were delighted to meet wi...

15-Year-old Finds Flaw in Ledger Crypto Wallet

A 15-year-old security researcher has discovered a serious flaw in cryptocurrency hardware wallets made by Ledger, a French company whose popular products are designed to physically safeguard public and private keys used to receive or spend the user’s cryptocurrencies. Ledger's Nano-S...

SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Critical Vulnerabilities product: SecurEnvoy SecurMail vulnerable version: 9.1.501 fixed version: 9.2.501 or hotfix patch "1012018" CVE number: CVE-2018-7701,...

Solaris 10 (sparc) : 119059-72

X11 6.6.2: Xsun patch. Date this patch was last updated by Sun : Mar/09/17 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Magento Downloadable Products Cross Site Scripting Vulnerability

Magento suffers from downloadable product information related cross site scripting vulnerabilities. Versions affected include Magento 2.0 prior to 2.0.18, Magento 2.1 prior to 2.1.12, and Magento 2.2 prior to 2.2.3. Advisory Title: Magento Stored Cross-Site Scripting a Downloadable Products...

Magento Product Attributes Cross Site Scripting Vulnerability

Magento suffers from product attribute information related cross site scripting vulnerabilities. Versions affected include Magento 2.0 prior to 2.0.18, Magento 2.1 prior to 2.1.12, and Magento 2.2 prior to 2.2.3. Advisory Title: Magento Stored Cross-Site Scripting a Product Attributes Advisory UR...

Spring data rest 远程代码执行(cve-2017-8046)

漏洞描述 漏洞描述 Spring Data Rest 在处理 PATCH 请求时存在RCE高危漏洞, 可以使用手工构造的JSON数据构造恶意PATCH请求提交至spring-data-rest服务器，使得服务器运行恶意JAVA代码。Spring Data Rest项目的目标是提供一种灵活的、可配置的机制，编写出可以对外暴露出HTTP协议的简单服务。 Git地址: https://github.com/spring-projects/spring-data-rest 漏洞来源: https://pivotal.io/security/cve-2017-8046 影响版本： Spring...

Magento User Info Cross Site Scripting Vulnerability

Magento suffers from user information related cross site scripting vulnerabilities. Versions affected include Magento 2.0 prior to 2.0.18, Magento 2.1 prior to 2.1.12, and Magento 2.2 prior to 2.2.3. Advisory Title: Magento Multiple Stored Cross-Site Scripting Vulnerabilities Advisory URL:...

Magento Backups Cross Site Request Forgery

DefenseCode Security Advisory Magento Backups Cross-Site Request Forgery Advisory ID: DC-2018-03-001 Advisory Title: Magento Backups Cross-Site Request Forgery Advisory URL: http://www.defensecode.com/advisories.php Software: Magento Version: Magento Open Source prior to 1.9.3.8, Magento Commerce...

Magento Product Attributes Cross Site Scripting

DefenseCode Security Advisory Magento Stored Cross-Site Scripting a Product Attributes Advisory ID: DC-2018-03-004 Advisory Title: Magento Stored Cross-Site Scripting a Product Attributes Advisory URL: http://www.defensecode.com/advisories.php Software: Magento Version: Magento 2.0 prior to 2.0.1...

Magento Downloadable Products Cross Site Scripting

DefenseCode Security Advisory Magento Stored Cross-Site Scripting a Downloadable Products Advisory ID: DC-2018-03-003 Advisory Title: Magento Stored Cross-Site Scripting a Downloadable Products Advisory URL: http://www.defensecode.com/advisories.php Software: Magento Version: Magento 2.0 prior to...

Welcome to the Cyber-Regulatory Market of 2018 and Beyond

In the past few years, we’ve seen an increase in the number of companies facing legal consequences for ineffectively meeting deadlines requiring them to measure the effectiveness of their security solutions. Combined with these deadlines, companies also have to prove they have awareness and contr...

4 Steps to Monitor and Audit Privileged Users of Data Stores

Changing regulatory requirements for protection and privacy of data and increasing numbers of data breaches are driving a greater focus on data protection. Understanding who is accessing critical data, what was accessed and when it was accessed is a critical component of strong security operation...