Microsoft Dynamics 365 XSS

The vulnerability of the Microsoft Dynamics 365 customer relationship management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

LinkedIn 'Job Offers' Targeted Aerospace, Military Firms With Malware

Attackers are impersonating human resource employees from Collins Aerospace and General Dynamics in a spear-phishing campaign leveraging LinkedIn’s messaging service. Targets are sent phony job offers that include malicious documents designed to fetch data-exfiltrating malware. The spear-phishing...

Security Updates for Microsoft Dynamics 365 (on-premises) (April 2020 OOB)

The Microsoft Dynamics 365 on-premises is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A cross-site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics...

Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics...

Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics...

PT-2020-2933

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics 365 affected versions not specified Description The issue is related to a lack of protection for the web page structure in Microsoft Dynamics 365, which can be exploited by a remote attacker to perform cross-site scripting...

PT-2020-2934

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics 365 affected versions not specified Description The issue is related to a lack of protection for the web page structure in Microsoft Dynamics 365, which can be exploited by a remote attacker to perform cross-site scripting...

CVE-2020-1063

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 On-Premise Cross Site Scripting Vulnerability'...

CVE-2020-1063

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics...

Cross site scripting

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 On-Premise Cross Site Scripting Vulnerability'...

CVE-2020-1063 Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability

...

CVE-2020-1063

CVE-2020-1063 is an authenticated-cross-site scripting vulnerability in Microsoft Dynamics 365 (on-premises). The Red Hat and Microsoft advisories corroborate that an attacker with valid authentication could exploit specially crafted web requests to run script in the user’s browser, reading or al...

CVE-2020-9045

During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used to perform the installation or upgrade are logged in a file. The install log file persists after the installation...

Information disclosure

During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used to perform the installation or upgrade are logged in a file. The install log file persists after the installation...

CVE-2020-9045

CVE-2020-9045 affects Software House C•CURE 9000 v2.70 and American Dynamics victor VMS v5.2. During installation or upgrade, the credentials of the user performing the process are logged to an install log file, which persists after installation. Publicly documented mitigations include upgrading ...

CVE-2020-9045: Cleartext Storage of Sensitive Information

During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used to perform the installation or upgrade are logged in a file. The install log file persists after the installation...

CVE-2020-1063: Improper Neutralization of Input During Web Page Generation

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics...

PT-2020-20458 · Software House +1 · Software House Ccure 9000 +1

Name of the Vulnerable Software and Affected Versions: Software House C•CURE 9000 version 2.70 American Dynamics victor Video Management System version 5.2 Description: The issue concerns the logging of user credentials during the installation or upgrade process. When installing or upgrading to t...

Johnson Controls Software House C-CURE 9000 and American Dynamics victor VMS

1. EXECUTIVE SUMMARY CVSS v3 9.9 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Equipment: Software House C•CURE 9000 and American Dynamics victor Video Management System Vulnerability: Cleartext Storage of...

Microsoft Dynamics 365 XSS

The vulnerability of the Microsoft Dynamics 365 resource planning software server is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks by using specially crafted requests...