Out-Of-Bounds Read

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Out-of-bounds Write

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Cross-Site Scripting (XSS)

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

CentOS Web Panel 0.9.8.793 (Free) / v0.9.8.753 (Pro) / 0.9.8.807 (Pro) - Domain Field (Add DNS Zone) Cross-Site Scripting

Exploit Title: CentOS Web Panel - Domain Field Add DNS Zone Cross-Site Scripting Vulnerability Google Dork: N/A Date: 22 - April - 2019 Exploit Author: DKM Vendor Homepage: http://centos-webpanel.com Software Link: http://centos-webpanel.com Version: v0.9.8.793 Free, v0.9.8.753 Pro and 0.9.8.807...

CentOS Web Panel Domain Field Cross Site Scripting

Exploit Title: CentOS Web Panel - Domain Field Add DNS Zone Cross-Site Scripting Vulnerability Google Dork: N/A Date: 22 - April - 2019 Exploit Author: DKM Vendor Homepage: http://centos-webpanel.com Software Link: http://centos-webpanel.com Version: v0.9.8.793 Free, v0.9.8.753 Pro and 0.9.8.807...

PT-2019-9061

Name of the Vulnerable Software and Affected Versions Odoo Community versions 8.0 through 11.0 Odoo Enterprise versions 9.0 through 11.0 Description The issue is related to incorrect access control in the RPC framework, allowing authenticated users to call private functions via RPC. Recommendatio...

Kingsoft pdf pc client software has a command execution vulnerability

Kingsoft PDF is by Kingsoft Office Software Limited out of a PDF file format for reading and processing tools. Kingsoft pdf pc client software there are command execution vulnerabilities, the software PC client can allow an attacker to inject executable DLL files in the client process, the...

Tencent TIM pc client software suffers from a command execution vulnerability

TIM, QQ Office Simple Edition, is a cross-platform communication tool that focuses on teamwork. Tencent TIM pc client software has a command execution vulnerability, the software PC client can allow an attacker to inject executable DLL files into the client process to execute arbitrary functions...

Command Execution Vulnerability in Tencent QQ pc Client Software

QQ, short for Tencent QQ, is an Internet-based instant messaging IM software developed by Tencent. A command execution vulnerability exists in the Tencent QQ pc client software, where the software PC client can allow an attacker to inject executable DLL files into the client process to perform...

Tencent video pc client software suffers from command execution vulnerability

Tencent Video is an online video platform that provides users with a high-definition and smooth video entertainment experience. Tencent Video pc client software has a command execution vulnerability, the software PC client can allow an attacker to inject an executable DLL file into the client...

PT-2019-3122

Name of the Vulnerable Software and Affected Versions Oracle Retail Convenience Store Back Office version 3.6 Description The issue is related to inadequate access control in the Level 3 Maintenance Functions component. It allows an unauthenticated attacker with network access via HTTP to...

CVE-2019-2424: Undefined Security Weakness

Vulnerability in the Oracle Retail Convenience Store Back Office component of Oracle Retail Applications subcomponent: Level 3 Maintenance Functions. The supported version that is affected is 3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CB TAU Threat Intelligence Notification: HopLight Campaign (Linked to North Korea) is Reusing Substantial Amount of Code

On April 10, 2019 the US Department of Homeland Security DHS released a Malware Analysis Report MAR-10135536-8 which detailed the trojan HopLight. HopLight has been linked to different North Korean DPRK campaigns also known as the Lazarus Group. The CB Threat Analysis Unit TAU has continued to...

GLib: Multiple vulnerabilities

Background GLib is a library providing a number of GNOME’s core objects and functions. Description Multiple vulnerabilities have been discovered in GLib. Please review the referenced bug for details. Impact Please review the referenced bugs for details. Workaround There is no known workaround at...

Oracle Retail Applications Retail Convenience Store Back Office Access Control Error Vulnerability

Oracle Retail Applications is the United States Oracle Oracle company's set of retail applications store solutions. The product includes inventory management, sales management and customer management , etc. Retail Convenience Store Back Office is one of the retail back office components. A securi...

CVE-2019-10261

CentOS Web Panel CWP 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functions" "Edit Nameservers IPs" action...

Cross site scripting

CentOS Web Panel CWP 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functions" "Edit Nameservers IPs" action...

CVE-2019-10261

CentOS Web Panel CWP 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functions" "Edit Nameservers IPs" action...

CVE-2019-10261

CWP 0.9.8.789 is vulnerable to Stored/Persistent XSS in the DNS Functions → Edit Nameservers IPs form (Name Server 1/2). Root cause: insufficient input sanitization, enabling an attacker to store and render script payloads to other users. CVE-2019-10261 is described across multiple records with b...

CVE-2019-10261: Improper Neutralization of Input During Web Page Generation

CentOS Web Panel CWP 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functions" "Edit Nameservers IPs" action...