TIBCO Security Advisory: November 6, 2018 - TIBCO Messaging - Apache Kafka Distribution - SchemaRepository

TIBCO Messaging - Apache Kafka Distribution - Schema Repository Vulnerable to CSRF Attacks Original release date:November 6, 2018 Last revised: CVE-2018-12413 Source: TIBCO Software Inc. TIBCO Messaging - Apache Kafka Distribution - Schema Repository Vulnerable to CSRF Attacks Original release...

TIBCO Security Advisory:November 6, 2018 - TIBCOFTL

TIBCO FTL Realm Server Vulnerable to CSRF Attacks Original release date: November 6,2018 Last revised: CVE-2018-12412 Source: TIBCO Software Inc. TIBCO FTL Realm Server Vulnerable to CSRF Attacks Original release date: November 6, 2018 Last revised: Source: TIBCO Software Inc. Systems Affected...

TIBCO Security Advisory:November 6, 2018 - TIBCOFTL

TIBCO FTL Realm Server Vulnerable to CSRF Attacks Original release date: November 6,2018 Last revised: CVE-2018-12412 Source: TIBCO Software Inc. TIBCO FTL Realm Server Vulnerable to CSRF Attacks Original release date: November 6, 2018 Last revised: Source: TIBCO Software Inc. Systems Affected...

TIBCO Security Advisory: November 6, 2018 - TIBCOActiveSpaces

TIBCO ActiveSpaces Administrative Daemon Vulnerable to CSRF Attacks Original release date: November 6, 2018 Last revised: CVE-2018-12411 Source: TIBCOSoftware Inc. TIBCO ActiveSpaces Administrative Daemon Vulnerable to CSRF Attacks Original release date: November 6, 2018 Last revised: Source: TIB...

SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2018:2322-2)

This update for MozillaFirefox to version ESR 52.9 fixes the following issues : CVE-2018-5188: Various memory safety bugs bsc1098998 CVE-2018-12368: No warning when opening executable SettingContent-ms files CVE-2018-12366: Invalid data handling during QCMS transformations CVE-2018-12365:...

OrientDB-Server vulnerable to Cross-Site Request Forgery

The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery CSRF attacks, and obtain sensitive information, via a crafted HTTP...

CVE-2018-12364

NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site. This allows for a malicious site to engage in cross-site request forgery CSRF attacks. This vulnerability affects Thunderbird 60,...

CVE-2018-12364

NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site. This allows for a malicious site to engage in cross-site request forgery CSRF attacks. This vulnerability affects Thunderbird 60,...

SUSE-SU-2018:2322-2 Security update for MozillaFirefox

This update for MozillaFirefox to version ESR 52.9 fixes the following issues: - CVE-2018-5188: Various memory safety bugs bsc1098998 - CVE-2018-12368: No warning when opening executable SettingContent-ms files - CVE-2018-12366: Invalid data handling during QCMS transformations - CVE-2018-12365:...

CVE-2018-15402 Cisco Enterprise NFV Infrastructure Software Cross-Site Request Forgery Vulnerability

A vulnerability in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote attacker to conduct cross-site request forgery CSRF attacks. The vulnerability is due to improper validation of Origin headers on HTTP requests within the management interface. An attacker...

Security update for seamonkey (important)

This update for seamonkey fixes the following issues: Mozilla Seamonkey was updated to 2.49.4: Now uses Gecko 52.9.1esr boo1098998. Security issues fixed with MFSA 2018-16 boo1098998: CVE-2018-12359: Buffer overflow using computed size of canvas element CVE-2018-12360: Use-after-free when using...

openSUSE: Security Advisory for MozillaThunderbird (openSUSE-SU-2018:2658-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for MozillaThunderbird (important)

This update for MozillaThunderbird to version 60.0 fixes the following issues: These security issues were fixed: - CVE-2018-12359: Prevent buffer overflow using computed size of canvas element bsc1098998. - CVE-2018-12360: Prevent use-after-free when using focus bsc1098998. - CVE-2018-12361:...

CVE-2018-15121

An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations...

CVE-2018-15121

An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations...

Cross-site Request Forgery (CSRF)

gleez/cms is vulnerable to cross-site request forgery CSRF attacks. The library does not have any CSRF tokens to prevent CSRF attacks, allowing a malicious administrator user to add another administrator user through the URL...

Amazon Linux 2 : thunderbird (ALAS-2018-1061)

Use-after-free when appending DOM nodes CVE-2018-12363 Use-after-free using focus CVE-2018-12360 Compromised IPC child process can list local filenames CVE-2018-12365 Buffer overflow using computed size of canvas element CVE-2018-12359 Using form to exfiltrate encrypted mail part by pressing ente...

Security vulnerabilities fixed in Thunderbird 60 — Mozilla

A buffer overflow can occur when rendering canvas content while adjusting the height and width of the element dynamically, causing data to be written outside of the currently computed boundaries. This results in a potentially exploitable crash. A use-after-free vulnerability can occur when deleti...

Critical: thunderbird

Issue Overview: Use-after-free when appending DOM nodes CVE-2018-12363 Use-after-free using focus CVE-2018-12360 Compromised IPC child process can list local filenames CVE-2018-12365 Buffer overflow using computed size of canvas element CVE-2018-12359 Using form to exfiltrate encrypted mail part ...

SuSE Update for seamonkey openSUSE-SU-2018:2330-1 (seamonkey)

Check the version of seamonkey SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.851855";...