Description of the security update for SharePoint Enterprise Server 2016: November 13, 2018

None None...

Barracuda MAS - (ldap_load_entry.cgi) XSS Vulnerability

Document Title: =============== Barracuda MAS - ldaploadentry.cgi XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2168 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20369 CVE-ID: ======= CVE-2018-20369 Release Date:...

GHSA-FWX5-5FQJ-JV98 Cross-Site Scripting in morris.js

Affected versions of morris.js are vulnerable to cross-site scripting attacks in labels that appear when hovering over a particular point on a generated graph. The text content of these labels is not escaped, so if control over the labels is obtained, script can be injected. The script will run o...

Cross-Site Scripting in morris.js

Affected versions of morris.js are vulnerable to cross-site scripting attacks in labels that appear when hovering over a particular point on a generated graph. The text content of these labels is not escaped, so if control over the labels is obtained, script can be injected. The script will run o...

Citrix NetScaler Gateway Cross-Site Scripting Vulnerability (CNVD-2019-01898)

Citrix NetScaler Gateway formerly Citrix Access Gateway Enterprise Edition is a secure remote access solution from Citrix Systems. The solution provides administrators with application-level and data-level controls to enable users to remotely access applications and data from any location. A...

Foreman cross-site scripting vulnerability (CNVD-2018-21250)

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A cross-site scripting vulnerability exists in Foreman 1.18 and later versions, which stems from the...

CVE-2018-14664

A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs bar. This allows a user with permissions to edit which attribute is used in the breadcrumbs bar to store code that will be executed on the...

EPS Viewer Buffer Overflow Vulnerability - Windows

EPS Viewer is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mass WordPress compromises redirect to tech support scams

Content Management Systems CMSes such as WordPress, Drupal, or Joomla are under a constant barrage of fire. Earlier this year, we detailed several waves of attacks against Drupal, also known as Drupalgeddon, pushing browser-based miners and various social engineering threats. During the past few...

CVE-2018-16590

FURUNO FELCOM 250 and 500 devices use only client-side JavaScript in login.js for authentication...

Authentication flaw

FURUNO FELCOM 250 and 500 devices use only client-side JavaScript in login.js for authentication...

CVE-2018-16590

FURUNO FELCOM 250 and 500 devices use only client-side JavaScript in login.js for authentication...

CVE-2018-16590

CVE-2018-16590 affects FURUNO FELCOM 250 and 500 devices, where authentication relies solely on client-side JavaScript in login.js. The root cause is described as client-side authentication, with no corroborated server-side validation in the provided documents. CVSS3 metrics indicate a critical s...

HackerOne: Self DOM-Based XSS in www.hackerone.com

Summary: There is a 'self' DOM-based cross-site scripting vulnerability in the contact form available on the www.hackerone.com website. This could allow an attacker to perform cross-site scripting, or other client-side attacks, against users of the application. However, the risk presented by this...

postgresql: Certain host connection parameters defeat client-side security defenses

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq were used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side...

USN-3758-2: libx11 vulnerabilities

USN-3758-1 fixed several vulnerabilities in libx11. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Tobias Stoeckmann discovered that libx11 incorrectly handled certain images. An attacker could possibly use this issue to access sensitive information...

postgresql: Certain host connection parameters defeat client-side security defenses

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq were used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side...

CVE-2018-15528

Reflected Cross-Site Scripting exists in the Java System Solutions SSO plugin 4.0.13.1 for BMC MyIT. A remote attacker can abuse this issue to inject client-side scripts into the "selectsso" function. The payload is triggered when the victim opens a prepared /ux/jss-sso/arslogin?XSS link and then...

Cross site scripting

Reflected Cross-Site Scripting exists in the Java System Solutions SSO plugin 4.0.13.1 for BMC MyIT. A remote attacker can abuse this issue to inject client-side scripts into the "selectsso" function. The payload is triggered when the victim opens a prepared /ux/jss-sso/arslogin?XSS link and then...

CVE-2018-15528

Reflected Cross-Site Scripting exists in the Java System Solutions SSO plugin 4.0.13.1 for BMC MyIT. A remote attacker can abuse this issue to inject client-side scripts into the "selectsso" function. The payload is triggered when the victim opens a prepared /ux/jss-sso/arslogin?XSS link and then...