1234 matches found
Security Bulletin: Multiple vulnerabilities in Kibana affect IBM Compose for Elasticsearch
Summary Multiple vulnerabilities in Kibana affect IBM Compose for Elasticsearch. Vulnerability Details CVEID: CVE-2019-7609 DESCRIPTION: Elastic Kibana could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Timelion visualizer. By sending a specially-crafte...
CVE-2019-1995
In ComposeActivityEmail of ComposeActivityEmail.java, there is a possible way to silently attach files to an email due to a confused deputy. This could lead to local information disclosure, sending files accessible to AOSP Mail to a remote email recipient, with no additional execution privileges...
VulnCheck KEV: CVE-2012-0791
Multiple cross-site scripting XSS vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 composeCache, 2 rtemode, or 3 filename parameters to the compose page; 4 formname parameter to the...
DFIRTrack - The Incident Response Tracking Application
DFIRTrack Digital Forensics and Incident Response Tracking application is an open source web application mainly based on Django using a PostgreSQL database backend. In contrast to other great incident response tools, which are mainly case-based and support the work of CERTs, SOCs etc. in their...
JSShell - An Interactive Multi-User Web JS Shell
An interactive multi-user web based javascript shell. It was initially created in order to debug remote esoteric browsers during experiments and research. This tool can be easily attached to XSS Cross Site Scripting payload to achieve browser remote code execution similar to the BeeF framework...
UBUNTU-CVE-2018-19199
An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery or uriComposeQueryEx function because of an unchecked multiplication...
DEBIAN-CVE-2018-19199
An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery or uriComposeQueryEx function because of an unchecked multiplication...
DEBIAN-CVE-2018-19198
An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an out-of-bounds write via a uriComposeQuery or uriComposeQueryEx function because the '&' character is mishandled in certain contexts...
CVE-2018-15856: Loop with Unreachable Exit Condition
An infinite loop when reaching EOL unexpectedly in compose/parser.c aka the keymap parser in xkbcommon before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted keymap files...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Gitlab
This repository is an offensive tool for a vulnerability environment. It is a Docker-Compose file for a vulnerability environment. The repository contains a .gitignore file, a README.md file, and several other files that are used to configure the environment. The .gitignore file contains a list o...
vulhub
This is a Docker Compose file for a vulnerability environment. It is a collection of services and their configurations that can be used to test and demonstrate various vulnerabilities. The file is written in YAML format and defines the services, their ports, and their dependencies. The services...
Exploit for Improper Encoding or Escaping of Output in F5 Nginx
This repository is an offensive tool for a vulnerability environment. It is a collection of Docker Compose files for various vulnerabilities, allowing users to easily set up and test vulnerable environments. The repository includes files for vulnerabilities such as CVE-2016-9086, CVE-2017-1000353...
vulhub
It is an offensive tool for web application exploitation. The repository contains a Docker Compose file for a vulnerability environment. The tool is designed to exploit vulnerabilities in web applications. The tool is likely used for testing and demonstrating vulnerabilities in web applications. ...
CVE-2018-9997
Cross-site scripting XSS vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject arbitrary web script or HTML via the data-target attribute in an HTML page wit...
CVE-2018-9997: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject arbitrary web script or HTML via the data-target attribute in an HTML page wit...
Open-Xchange App Suite Cross-Site Scripting Vulnerability
Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to more intuitively manage email, tasks, files, etc. mail compose is one of the mail editing components. A cross-site scripting vulnerability exists in the mail compose...
Mail.ru: XSS touch.mail.ru compose Body
Domain, site, application -- touch.mail.ru Testing environment -- Mobile devices tested on Chrome for iPad Steps to reproduce -- login using Chrome in Chrome for iPad User-Agent https://touch.mail.ru/messages/sentmsg?Body=%3Cimg%20src%20onerror%3dalert1%3E Actual results -- alert1 Expected result...
CVE-2018-8059
The Djelibeybi configuration examples for use of NGINX in SUSE Portus 2.3, when applied to certain configurations involving Docker Compose, have a Missing SSL Certificate Validation issue because no proxyssl directives are used...
Input validation
The Djelibeybi configuration examples for use of NGINX in SUSE Portus 2.3, when applied to certain configurations involving Docker Compose, have a Missing SSL Certificate Validation issue because no proxyssl directives are used...
CVE-2018-8059
The Djelibeybi configuration examples for use of NGINX in SUSE Portus 2.3, when applied to certain configurations involving Docker Compose, have a Missing SSL Certificate Validation issue because no proxyssl directives are used...