1064 matches found
[SECURITY] [DLA 2204-1] mailman security update
Package : mailman Version : 1:2.1.18-2+deb8u6 CVE ID : CVE-2020-12108 It was discovered that there was an arbitrary content injection vulnerability in the Mailman mailing list manager. For Debian 8 "Jessie", this issue has been fixed in mailman version 1:2.1.18-2+deb8u6. We recommend that you...
GNU Mailman Injection Vulnerability
GNU Mailman is a free suite of software from the GNU Project for managing e-mail discussions and e-mail lists. The software can be integrated with Web projects to make it easy for users to manage e-mail subscription accounts and provides built-in archiving, automatic forwarding processing, conten...
FreeBSD : mailman -- arbitrary content injection vulnerability via options or private archive login pages (88760f4d-8ef7-11ea-a66d-4b2ef158be83)
Mark Sapiro reports : A content injection vulnerability via the options login page has been discovered and reported by Vishal Singh. An issue similar to CVE-2018-13796 exists at different endpoint & param. It can lead to a phishing attack. added 2020-05-07 This is essentially the same as...
CVE-2020-12108
/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection...
CVE-2020-12108
/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection...
Design/Logic Flaw
/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection...
CVE-2020-12108
/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection...
UBUNTU-CVE-2020-12108
/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection...
CVE-2020-12108
/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection...
CVE-2020-12108
Summary: CVE-2020-12108 affects GNU Mailman prior to 2.1.31, allowing Arbitrary Content Injection via the /options/mailman page (and related login/archival areas per advisories). Affected software: Mailman 2.1.x series before 2.1.31. Root cause / vector: improper handling on the options/login pat...
WordPress LifterLMS Plugin < 3.35.0 Unauthenticated Options Import Vulnerability
The WordPress plugin Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
mailman -- arbitrary content injection vulnerability via options or private archive login pages
Mark Sapiro reports: A content injection vulnerability via the options login page has been discovered and reported by Vishal Singh. An issue similar to CVE-2018-13796 exists at different endpoint & param. It can lead to a phishing attack. added 2020-05-07 This is essentially the same as...
Security Updates for Microsoft Dynamics 365 (on-premises) (April 2020)
The Microsoft Dynamics 365 on-premises is missing security updates. It is, therefore, affected by the following vulnerability: - A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics...
Mail.ru: Content injection on shared event (calendar.mail.ru)
Allowed tags/attributes for calendar events in calendar.mail.ru were not properly restricted allowing interface elements spoofing...
Glassdoor: XSS at https://www.glassdoor.com/Salary/* via filter.jobTitleExact
Summary: There exists a Cross Site Scripting and Content Injection vulnerability at https://www.glassdoor.com/Salary/ via the filter.jobTitleExact query parameter. Using URL encoded HTML entities, it is possible to inject HTML content and break out of the context of a tag. The WAF does a good job...
Default development error handler in Ratpack is vulnerable to HTML content injection (XSS)
Versions of Ratpack from 0.9.10 through 1.7.5 are vulnerable to CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' aka. XSS in the development error handler. An attacker can utilize this to perform XSS when an exception message contains untrusted data. As a...
Microsoft Dynamics 365 Field Service Cross-Site Scripting Vulnerability
Microsoft Dynamics 365 Field Service is a field service management system, a business application that helps organizations deliver field service to customer locations. This application combines workflow automation, scheduling algorithms, and mobility to arm employees to make it successful when...
CVE-2014-3743
Multiple cross-site scripting XSS vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 gfm codeblocks language or 2 javascript url's. sanitize: true Even if this option is set, marked is vulnerable to...