4072 matches found
CVE-2019-15829: Improper Neutralization of Input During Web Page Generation
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS...
Adwind Spyware-as-a-Service Attacks Utility Grid Operators
A phishing campaign that spoofs a PDF attachment to deliver Adwind spyware has been taking aim at national grid utilities infrastructure. Adwind, a.k.a. JRAT or SockRat, is being used in a malware-as-a-service model in this campaign, researchers said. It offers a full cadre of info-gathering...
CVE-2018-20871
In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on rootsquash, weak file permissions "other" write access occur in certain cases GE-6890...
CVE-2018-20871
In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on rootsquash, weak file permissions "other" write access occur in certain cases GE-6890...
UBUNTU-CVE-2018-20871
In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on rootsquash, weak file permissions "other" write access occur in certain cases GE-6890...
Code injection
In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on rootsquash, weak file permissions "other" write access occur in certain cases GE-6890...
CVE-2018-20871
In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on rootsquash, weak file permissions "other" write access occur in certain cases GE-6890...
CVE-2018-20871
In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on rootsquash, weak file permissions "other" write access occur in certain cases GE-6890...
CVE-2018-20871
In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on rootsquash, weak file permissions "other" write access occur in certain cases GE-6890...
CVE-2018-20871
CVE-2018-20871 affects Univa Grid Engine before 8.6.3. When configured for Docker jobs and execd spooling on root_squash, weak file permissions (world-write) may occur in certain cases (GE-6890). Impact is partial confidentiality/integrity/availability as per CVSS, but exploitation details are no...
CVE-2018-20871: Incorrect Permission Assignment for Critical Resource
In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on rootsquash, weak file permissions "other" write access occur in certain cases GE-6890...
PT-2019-10300
Name of the Vulnerable Software and Affected Versions: Univa Grid Engine versions prior to 8.6.3 Description: The issue arises when Univa Grid Engine is configured for Docker jobs and execd spooling on root squash, leading to weak file permissions with "other" write access in certain cases...
@admui/grid (>=0.1.10, <=0.3.1), @astro-my/design-systems (>=0.3.14, <=0.4.42) +204 more potentially affected by CVE-2019-10744 via lodash-es (>=3.0.0, <=4.17.12)
lodash-es NPM version =3.0.0, =0.1.10, =0.3.14, =0.4.63, =0.1.1, =0.1.1, =0.3.2-a, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.5.24 and more Source cves: CVE-2019-10744 Source advisory: MEND:CVE-2019-10744...
PT-2019-12690
Name of the Vulnerable Software and Affected Versions H3C H3Cloud OS affected versions not specified Description The issue allows SQL injection via the ear/grid event API endpoint, specifically through the sidx parameter. Recommendations At the moment, there is no information about a newer versio...
WPZD-163(II) Distribution Grid Integration Measurement and Control Terminal has Logic Flaw Vulnerability
Xuji Group Co., Ltd. is a high-tech modern industrial group specializing in electric power, automation and intelligent manufacturing. WPZD-163II Power Distribution Grid Integration Measurement and Control Terminal suffers from a logic flaw vulnerability that can be exploited by attackers to...
Gallery Photoblocks < 1.1.41 - Unauthenticated Reflected XSS
Also Full Path Disclosure depending on the configuration of the server https:///wp-content/plugins/photoblocks-grid-gallery/admin/partials/photoblocks-edit.php?id="...
Stored cross-site scripting in Grid component in Vaadin 7 and 8
Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 Vaadin 7.4.0 through 7.7.19, and 8.0.0 through 8.8.4 Vaadin 8.0.0 through 8.8.4 allows attacker to inject malicious JavaScript via unspecified vector. See CWE-80: Improper Neutralization of...
Threat Source newsletter (June 20, 2019)
Newsletter compiled by Jonathan Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. This week, we disclosed two vulnerabilities in KCodes’ NetUSB kernel module contains that could allow an attacker to inappropriatel...
The Highly Dangerous 'Triton' Hackers Have Probed the US Grid
The same hackers behind a potentially lethal 2017 oil refinery cyberattack are now sniffing at US electrical utility targets...
Cross-Site Scripting
Overview Versions of ag-grid-community prior to 14.0.0 are vulnerable to Cross-Site Scripting XSS. Grid contents are not properly sanitized and may allow attackers to execute arbitrary JavaScript if user input is rendered in the grid. Recommendation Upgrade to version 14.0.0 or later References -...