Apache Struts REST plugin XStream deserialization vulnerability

Added: 09/08/2017 CVE: CVE-2017-9805 BID: 100609 Background Apache Struts is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model-view-controller MVC architecture. Problem The REST plugi...

CVE-2017-12426

CVE-2017-12426 affects GitLab CE/EE: versions before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4, may allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import. CVSSv3 base score 8.8 (HIGH); CV...

CVE-2017-11437

GitLab Enterprise Edition EE before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirroring feature to potentially read repositories belonging to other users...

ladu24.ee XSS vulnerability

Vulnerable URL: https://www.ladu24.ee/varuosad/5/,,,,%253C%252Fscript%253E%253Cimg%2Bsrc%253Dx%2Bonerror%253Dprompt%2528%252FXSSPOSED%252F%2529%253Egsc.tab=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.10.2017 Vulnerability type:| XSS Vulnerability status:| Public...

CVE-2017-1000009

Akeneo PIM CE and EE are affected by a shell injection vulnerability in the mass edition feature for versions < 1.6.6, < 1.5.15, and

ladu24.ee XSS vulnerability

Vulnerable URL: https://www.ladu24.ee/varuosad/3/,,,,%253C%252Fscript%253E%253Cimg%2Bsrc%253Dx%2Bonerror%253Dprompt%2528%252FXSSPOSED%252F%2529%253Egsc.tab=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Public...

ladu24.ee XSS vulnerability

Vulnerable URL: https://www.ladu24.ee/varuosad/2/,,,,%253C%252Fscript%253E%253Cimg%2Bsrc%253Dx%2Bonerror%253Dprompt%2528%252FXSSPOSED%252F%2529%253Egsc.tab=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Public...

ladu24.ee XSS vulnerability

Vulnerable URL: https://www.ladu24.ee/varuosad/0/,,,,%253C%252Fscript%253E%253Cimg%2Bsrc%253Dx%2Bonerror%253Dprompt%2528%252FXSSPOSED%252F%2529%253Egsc.tab=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Public...

CVE-2016-9469

Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance. For GitLab instances with publicly available projects this vulnerability could be exploited by an unauthenticated user. A fix...

CVE-2016-4010: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

[SECURITY] Fedora 25 Update: springframework-security-3.2.10-1.fc25

Spring Security is a Java/Java EE framework that provides advanced authentication, authorization and other comprehensive security features for enterprise applications. In addition to having a comprehensive list of security functionality, Spring Security is very configurable and employs the Spring...

Cross-site Scripting Vulnerability in ZhengTong Content Management System

The GovContent Management System is a website management system designed and built on the JAVA EE platform, which is mainly used for the website construction and management of government agencies, enterprises and institutions. A cross-site scripting vulnerability exists in the CMS. The...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 7.0.3 for RHEL 7

Updated packages that provides Red Hat JBoss Enterprise Application Platform 7.0.3, fixes several bugs, and adds various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

RHEL 6 : jboss-ec2-eap (RHSA-2016:2072)

An update for jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Moderate: Red Hat Security Advisory: jboss-ec2-eap security and enhancement update for EAP 6.4.11

An update for jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

auto24.ee Open Redirect vulnerability

Open Bug Bounty ID: OBB-176216 Description| Value ---|--- Affected Website:| auto24.ee Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet Vulnerable...

Apache Struts Dynamic Method Invocation command execution

Added: 05/06/2016 CVE: CVE-2016-3081 Background Apache Struts is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model-view-controller MVC architecture. The Dynamic Method Invocation...

kaup24.ee XSS vulnerability

Open Bug Bounty ID: OBB-149313 Description| Value ---|--- Affected Website:| kaup24.ee Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to Analytics Web General...

CVE-2016-0468

Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to Analytics Web General...