Vulnerabilities in financial mobile apps put consumers and businesses at risk

Security hubris. It’s the phrase we use to refer to our feeling of confidence grounded on assumptions we all have but may not be aware of or care to admit about cybersecurity—and, at times, privacy. It rears its ugly head when 1 we share the common notion that programmers know how to code securel...

Design/Logic Flaw

A log poisoning vulnerability has been discovered in the OneShield Policy Dragon Core framework before 5.1.10. Authenticated remote adversaries can poison log files by entering malicious payloads in either headers or form elements. These payloads are then executed via a client side debugging...

CVE-2019-11642

A log poisoning vulnerability has been discovered in the OneShield Policy Dragon Core framework before 5.1.10. Authenticated remote adversaries can poison log files by entering malicious payloads in either headers or form elements. These payloads are then executed via a client side debugging...

Prinect Archive System Cross-Site Scripting Vulnerability

Prinect Archive System is a document print archive system. A cross-site scripting vulnerability exists in Prinect Archive System 2015 release 2.6. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to...

Sonatype Nexus Repository Manager Cross-Site Scripting Vulnerability (CNVD-2019-13256)

Sonatype Nexus Repository Manager NXRM is a Maven repository manager from Sonatype USA. A cross-site scripting vulnerability exists in Sonatype NXRM, which stems from a WEB application that fails to properly validate client-side data and can be exploited by an attacker to execute client-side code...

CVE-2019-1859

A vulnerability in the Secure Shell SSH authentication process of Cisco Small Business Switches software could allow an attacker to bypass client-side certificate authentication and revert to password authentication. The vulnerability exists because OpenSSH mishandles the authentication process. ...

CVE-2019-1859

A vulnerability in the Secure Shell SSH authentication process of Cisco Small Business Switches software could allow an attacker to bypass client-side certificate authentication and revert to password authentication. The vulnerability exists because OpenSSH mishandles the authentication process. ...

Design/Logic Flaw

A vulnerability in the Secure Shell SSH authentication process of Cisco Small Business Switches software could allow an attacker to bypass client-side certificate authentication and revert to password authentication. The vulnerability exists because OpenSSH mishandles the authentication process. ...

CVE-2019-1859 Cisco Small Business Switches Secure Shell Certificate Authentication Bypass Vulnerability

A vulnerability in the Secure Shell SSH authentication process of Cisco Small Business Switches software could allow an attacker to bypass client-side certificate authentication and revert to password authentication. The vulnerability exists because OpenSSH mishandles the authentication process. ...

GitLab: DoS attack via comment on Issue

Summary There is no limit to the number of characters in the issue comments, which allows a DoS attack. The DoS attack affects both server-side and client-side. NOTE: This bug happens on GitLab.com. Steps to reproduce ▼Attack for Client-side 1. Sign in to GitLab. 2. Create a project as below: -...

Open redirect

In AdBlock before 3.45.0, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect...

CVE-2019-11594

In AdBlock before 3.45.0, the $rewrite filter option lets filter-list maintainers run arbitrary code in a client-side session when a web service loads a script via XMLHttpRequest or Fetch and the script origin has an open redirect. This vulnerability is scored CVSS v3.0: 8.1 (HIGH) with Network a...

Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2019-12707)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A cross-site scripting vulnerability exists in Cybozu Garoon versions 4.0.0 through 4.6.3, which originates from ...

Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2019-12706)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A cross-site scripting vulnerability exists in Cybozu Garoon versions 4.0.0 through 4.6.3, which originates from ...

Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2019-12699)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A cross-site scripting vulnerability exists in Cybozu Garoon versions 4.0.0 through 4.10.1, which originates from...

Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2019-12704)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A cross-site scripting vulnerability exists in Cybozu Garoon versions 4.6.0 through 4.6.3, which originates from ...

Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2019-12701)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A cross-site scripting vulnerability exists in Cybozu Garoon versions 4.0.0 through 4.10.1, which originates from...

Sierra Wireless AirLink ES450 Cross-Site Scripting Vulnerability

The Sierra Wireless AirLink ES450 is a cellular network modem device from Sierra Wireless Canada. A cross-site scripting vulnerability exists in the ACEManager pingresult.cgi function in the Sierra Wireless AirLink ES450 using firmware version 4.9.3, which stems from a lack of proper validation o...

IBM Jazz Reporting Service Cross-Site Scripting Vulnerability (CNVD-2019-13241)

IBM Jazz Reporting Service JRS is a suite of applications for discovering cross-project reports from IBM in the United States. A cross-site scripting vulnerability exists in IBM JRS Report Builder that stems from the WEB application failing to validate client-side data, which can be exploited by ...

Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2019-12700)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A cross-site scripting vulnerability exists in Cybozu Garoon versions 4.0.0 through 4.10.1, which originates from...