WordPress: Stored XSS in Post Preview as Contributor

Root cause I noticed that the getthecontent makes a pregreplacecallback after all other validation and sanitization has been performed. function getthecontent $morelinktext = null, $stripteaser = false global $page, $more, $preview, $pages, $multipage; $post = getpost; ... if $preview // Preview...

UBUNTU-CVE-2018-19888

An invalid memory address dereference was discovered in the huffcode function libfaac/huff2.c in Freeware Advanced Audio Coder FAAC 1.29.9.2. The vulnerability causes a segmentation fault and application crash, which leads to denial of service in the HCBESC case...

CVE-2018-0106

A vulnerability in the ConfD server of the Cisco Elastic Services Controller ESC could allow an unauthenticated, local attacker to access sensitive information on a targeted system. The vulnerability is due to insufficient security restrictions. An attacker could exploit this vulnerability by...

CVE-2018-0106

CVE-2018-0106 affects the Cisco Elastic Services Controller (ESC) and its embedded ConfD server . The vulnerability is due to insufficient security restrictions in the ConfD directory/file structure, enabling an unauthenticated, local attacker to view sensitive information on the targeted system....

CVE-2017-6778

A vulnerability in the Elastic Services Controller ESC web interface of the Cisco Ultra Services Platform could allow an authenticated, remote attacker to acquire sensitive information. The vulnerability is due to the transmission of sensitive information as part of a GET request. An attacker cou...

CVE-2017-6778

Cisco Ultra Services Platform's Elastic Services Controller Web Interface (ESC) is affected. An authenticated, remote attacker can disclose sensitive deployment information via a GET request. Affected release: 21.0.v0.65839. Root cause: transmitting sensitive information as part of a GET request....

CVE-2017-6709

A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller ESC and Cisco OpenStack deployments in an affected system. The vulnerability exists because the...

Code injection

A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller ESC and Cisco OpenStack deployments in an affected system. The vulnerability exists because the...

CVE-2017-6709

The CVE-2017-6709 case concerns Cisco’s Ultra Services Framework AutoVNF, where the AutoVNF tool logs administrative credentials in plaintext. This creates a risk that an unauthenticated, remote attacker could read credentials from the log files stored at the AutoVNF URL, enabling access to Cisco...

CVE-2017-6713

CVE-2017-6713 affects Cisco Elastic Services Controller (ESC) where the Play Framework UI uses static, default credentials shared across installations. The root cause is these credentials enabling an unauthenticated attacker to generate an admin session token and gain full web UI access. Affected...

esc-obog.org XSS vulnerability

Vulnerable URL: http://www.esc-obog.org/bulletin/post.asp?depth=2=1"...

gaswcc.org XSS vulnerability

Vulnerable URL: http://www.gaswcc.org/esc-courses.php?courselevel=1/-///'/"//--...

Cisco Elastic Services Controller Arbitrary Command Execution Vulnerability

Cisco Elastic Services Controller is a cloud and systems management solution. A security vulnerability in the esclistener.py script in Cisco Elastic Services Controllers could allow an authenticated, remote attacker to run arbitrary commands as the tomcat user on an affected system...

CVE-2017-6683

A vulnerability in the esclistener.py script of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to execute arbitrary commands as the tomcat user on an affected system, aka an Authentication Request Processing Arbitrary Command Execution Vulnerability. More...

Command injection

A vulnerability in the esclistener.py script of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to execute arbitrary commands as the tomcat user on an affected system, aka an Authentication Request Processing Arbitrary Command Execution Vulnerability. More...

CVE-2017-6683

CVE-2017-6683 affects Cisco Elastic Services Controller, specifically the esc_listener.py script. An authenticated, remote attacker could execute arbitrary commands as the tomcat user due to insufficient sanitization of arguments during authentication to the monitoring daemon (port 6000). Affecte...

Apple macOS/iOS Kernel 10.12.3 (16D32) - 'bpf' Heap Overflow

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1125 The bpf ioctl BIOCSBLEN allows userspace to set the bpf buffer length: case BIOCSBLEN: / uint / if d-bdbif != 0 error = EINVAL; else uint size; bcopyaddr, &size, sizeof size; if size bpfmaxbufsize size = bpfmaxbufsize; else ...

esc-larochelle.fr XSS vulnerability

Vulnerable URL: http://www.esc-larochelle.fr/content/search?SearchText=%22%3E%3Cscript%3Ealert%27OPENBUGBOUNTY%27%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 24.11.2017 Latest check for patch:| 24.11.2017 18:54 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

IoT Insecurity: Top Connected Device Security Concerns

It’s a coin toss whether or not that Internet of Things device you depend on is secure. Those unacceptable 50/50 odds come from a survey by IOActive where technology professionals were asked about the security of connected devices from thermostats, security cameras to alarm systems. Those numbers...

The plant controller has a remote vulnerability and no patch-vulnerability warning-the black bar safety net

Power station use of an industrial control system has not patched the vulnerability, an attacker can remotely exploit it to gain network control. Remedy method? Turning off the function or replace the equipment. Power station use of an industrial control system has not patched the vulnerability, ...