Code injection

In JetBrains PhpStorm before 2020.3, source code could be added to debug logs...

CVE-2021-25764

PhpStorm (JetBrains) before 2020.3 is affected: the issue lets source code be written into debug logs (“Source code could be added to debug logs”). The vulnerability affects PhpStorm’s logging path and can lead to information disclosure via logs. The issue is tracked as CVE-2021-25764. Remediatio...

CVE-2021-25764

In JetBrains PhpStorm before 2020.3, source code could be added to debug logs...

PT-2021-16776

Name of the Vulnerable Software and Affected Versions JetBrains PhpStorm versions prior to 2020.3 Description The issue allows source code to be added to debug logs. Recommendations For versions prior to 2020.3, update to version 2020.3 or later to resolve the issue...

JetBrains PhpStorm 安全漏洞

JetBrains PhpStorm is an application from the Czech JetBrains company. It provides an application for writing code. A security vulnerability exists in JetBrains PhpStorm before 2020.3, which originates from code that can be added to the debug log...

CVE-2021-25764: Undefined Security Weakness

In JetBrains PhpStorm before 2020.3, source code could be added to debug logs...

Eclipse Theia Cross-Site Scripting Vulnerability

Eclipse Theia is the Eclipse Foundation's set of Visual Studio Code-based open source integrated development environment for desktop and Web applications framework. A cross-site scripting vulnerability exists in Eclipse Theia 1.8.0 and prior versions, which stems from the absence of HTML escaping...

Girsh - Automatically Spawn A Reverse Shell Fully Interactive

Who didn't get bored of manually typing the few lines to upgrade a reverse shell to a full interactive reverse shell tty spawn, stty size ..., stty raw -echo or typing the command to use ConPTY. Description With Girsh, just run it and it will detect the OS and execute the correct commands to...

CVE-2021-28161

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...

CVE-2021-28161

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...

CVE-2021-28161

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...

Code injection

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...

CVE-2021-28161

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...

CVE-2021-28161

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...

PT-2021-17783

Name of the Vulnerable Software and Affected Versions: Eclipse Theia versions up to and including 1.8.0 Description: The issue concerns the lack of HTML escaping in the debug console, allowing arbitrary Javascript code to be injected. Recommendations: For Eclipse Theia versions up to and includin...

CVE-2021-28161: Improper Neutralization of Input During Web Page Generation

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...

Eclipse Theia 跨站脚本漏洞

Eclipse Theia is the Eclipse Foundation's set of Visual Studio Code-based open source integrated development environment for desktop and Web applications framework. A cross-site scripting vulnerability exists in Eclipse Theia 1.8.0 and prior versions, which stems from the absence of HTML escaping...

EPA scan results are not getting displayed in ns.log when EPA policies are configured through N-Factor Authentication.

When EPA policies are configured through N-Factor Authentication, then EPA Scan results will not be displayed in the ns.log despite Debug log level is enabled...

Security Bulletin: IBM Verify Gateway does not hide client secrets when debug tracing is active (CVE-2020-4372)

Summary When the IBM Verify Gateway IVG components are run with debug tracing, client secrets such as the username, password, and client-id are included in the debug log. As of v1.0.1 of IVG for RADIUS and IVG for AIX PAM, and v1.0.2 of IVG for Linux PAM and IVG for Windows Login, these client...

Security Bulletin: IBM Verify Gateway PAM components include a leftover debug file (CVE-2020-4371)

Summary The IBM Verify Gateway IVG PAM components include a leftover header file in their installation packages. The file was needed for debugging during development and shouldn't be part of the delivered PAM components. As of v1.0.1 of IVG for AIX PAM, and v1.0.2 of IVG for Linux PAM, the file h...