Announcing the Microsoft Azure DevOps Bounty program

The Microsoft Security Response Center MSRC is pleased to announce the launch of the Azure DevOps Bounty program, a program dedicated to providing rock-solid security for our DevOps customers. Starting January 17, 2019, we’re excited to offer rewards up to US$20,000 for eligible vulnerabilities i...

Wrong GPG Key Selection

Evolution is vulnerable to wrong GPG key selection. Due to a flaw in the way of GnuPG public keys selection, the package causes the emails being encrypted with public keys other than the one belonging to the intended recipient...

Arbitrary File Read

evolution is vulnerable to arbitrary file read attacks. The vulnerability exists as GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email...

Fedora 28 : evolution / evolution-data-server / evolution-ews (2018-1434efb8f3)

Update to 3.28.4 upstream release Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Zurmo 2.3.4 Cross Site Scripting

Code Evolution PHP Vulnerability in Zurmo 2.3.4 Information -------------------- Advisory by Netsparker Name: Code Evolution PHP in Zurmo 2.3.4 Affected Software: Zurmo Affected Versions: 2.3.4 Homepage: http://zurmo.org/ Vulnerability: Code evolution PHP Severity: Critical Status: Not Fixed CVSS...

Evolution CMS Cross-Site Scripting Vulnerability

Evolution CMS is a content management system CMS. A cross-site scripting vulnerability exists in Evolution CMS version 1.4.x, which can be exploited by remote attackers to inject arbitrary web script or HTML by sending the 'search' parameter to the manager/ URI...

Evolution CMS Cross-Site Scripting Vulnerability (CNVD-2019-03273)

Evolution CMS is a content management system CMS. A cross-site scripting vulnerability exists in Evolution CMS version 1.4.x, which can be exploited by remote attackers to inject arbitrary web script or HTML by sending the 'page weblink title' parameter to the manager/ URI...

Cross site scripting

Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI...

Design/Logic Flaw

Evolution CMS 1.4.x allows XSS via the manager/ search parameter...

CVE-2018-16638

Evolution CMS 1.4.x allows XSS via the manager/ search parameter...

CVE-2018-16637

Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI...

CVE-2018-16637

Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI...

CVE-2018-16638

Evolution CMS 1.4.x allows XSS via the manager/ search parameter...

CVE-2018-16637

Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI...

CVE-2018-16638

Evolution CMS 1.4.x allows XSS via the manager/ search parameter...

CVE-2018-16638

Evolution CMS 1.4.x is affected by a Cross‑Site Scripting (XSS) vulnerability in the manager/ search parameter. The CVE-2018-16638 entry documents an XSS flaw that can be triggered via the manager/ URL parameter, with the affected product specified as Evolution CMS 1.4.x. The provided connected d...

CVE-2018-16637

Evolution CMS 1.4.x is affected by a stored cross-site scripting (XSS) vulnerability that can be triggered via the page weblink title parameter to the manager/ URI. The issue is documented as XSS (including advisories noting versions prior to 1.4.6 are affected). Remediation per the linked adviso...

CVE-2018-1000889

Logisim Evolution version 2.14.3 and earlier contains an XML External Entity XXE vulnerability in Circuit file loading functionality loadXmlFrom in src/com/cburch/logisim/file/XmlReader.java that can result in information leak, possible RCE depending on system configuration. This attack appears t...

CVE-2018-1000889

Logisim Evolution version 2.14.3 and earlier contains an XML External Entity XXE vulnerability in Circuit file loading functionality loadXmlFrom in src/com/cburch/logisim/file/XmlReader.java that can result in information leak, possible RCE depending on system configuration. This attack appears t...

Xxe

Logisim Evolution version 2.14.3 and earlier contains an XML External Entity XXE vulnerability in Circuit file loading functionality loadXmlFrom in src/com/cburch/logisim/file/XmlReader.java that can result in information leak, possible RCE depending on system configuration. This attack appears t...