CVE-2019-3864

A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF token. The token is not refreshed for every request or when a user logged out and in again. An attacker could use a leaked token to...

Cross site request forgery (csrf)

A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF token. The token is not refreshed for every request or when a user logged out and in again. An attacker could use a leaked token to...

CVE-2019-3864

CVE-2019-3864 affects all quay-2 versions prior to quay-3.0.0, where the Quay web GUI uses a CSRF token embedded in a POST parameter that is not refreshed per request or on logout, enabling an attacker with a leaked token to access a user’s account. Affected product: Red Hat Quay (Quay web applic...

CVE-2019-3864

A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF token. The token is not refreshed for every request or when a user logged out and in again. An attacker could use a leaked token to...

Andriller - Software Utility With A Collection Of Forensic Tools For Smartphones

Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices. It has features, such as powerful Lockscreen cracking for Pattern, PIN code, or Password; custom decoders for Apps data...

Cisco IP Phone 6800, 7800 and 8800 Series Cross-Site Scripting Vulnerability

The Cisco IP Phone 6800, 7800, and 8800 Series are all IP phone families. A cross-site scripting vulnerability exists in the web-based GUI in the Cisco IP Phone 6800, 7800, and 8800 Series using Multiplatform Firmware Release prior to 11.31, which stems from the GUI failing to adequately validate...

Fedora Update for cutter-re FEDORA-2019-e931422a81

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware Cross-Site Scripting Vulnerability

A vulnerability in the web-based GUI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface of an affected system. The vulnerability is due to...

The vulnerability of the mysql-gui-tools package (including mysql-query-browser and mysql-admin) arises from the storage of user credentials in an unencrypted form, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the mysql-gui-tools package including mysql-query-browser and mysql-admin is related to the storage of user credentials in an unencrypted form. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information through the list of runni...

Unable to access SDWAN management GUI once after upgrading to 11.0.2 and the Device is rebooted

You will experience the GUI accessibility issue when you upgrade SDWAN appliance to 11.0.2 version and when it gets rebooted either automatically or manually...

CVE-2019-18181

In CloudVision Portal all releases in the 2018.1 and 2018.2 Code train allows users with read-only permissions to bypass permissions for restricted functionality via CVP API calls through the Configlet Builder modules. This vulnerability can potentially enable authenticated users with read-only...

Nord Security: User password left in memory in plain text after GUI launch

Summary When NordVPN GUI has sensitive data in memory and has no further need for it, it should wipe the data out of its memory, in case malware later gains access to the NordVPN process or the memory is swapped out to disk or written into a crash dump file. An obvious example of this is the user...

Debian DLA-2038-2 : x2goclient regression update

A change introduced in libssh 0.6.3-4+deb8u4 which got released as DLA 2038-1 has broken x2goclient's way of scp'ing session setup files from client to server, resulting in an error message shown in a GUI error dialog box during session startup and session resuming. For Debian 8 'Jessie', this...

EulerOS 2.0 SP2 : wireshark (EulerOS-SA-2019-2425)

According to the versions of the wireshark packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Wireshark is a network traffic analyzer for Unix-ish operating systems.This package lays base for libpcap, a packet capture and filtering...

Wikibase Wikidata Query Service GUI HTML Injection Vulnerability

Wikibase Wikidata Query Service GUI is a graphical user interface for the Wikidata wikidata query service. A security vulnerability exists in the ui/editor/tooltip/Rdf.js file in versions prior to Wikibase Wikidata Query Service GUI 0.3.6-SNAPSHOT 2019-11-07. An attacker can exploit the...

Unspecified Vulnerability in Wikibase Wikidata Query Service GUI

Wikibase Wikidata Query Service GUI is a graphical user interface for the Wikidata wikidata query service. A security vulnerability exists in the ui/ResultView.js file in versions prior to Wikibase Wikidata Query Service GUI 0.3.6-SNAPSHOT 2019-11-07. An attacker can exploit the vulnerability to...

Design/Logic Flaw

ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT...

Design/Logic Flaw

ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT...

CVE-2019-19327

The CVE-2019-19327 entry pertains to the Wikibase Wikidata Query Service GUI: the file ui/ResultView.js in versions prior to 0.3.6-SNAPSHOT (2019-11-07) is vulnerable to HTML injection when reporting the number of results and the number of milliseconds. The note indicates this GUI code is no long...

CVE-2019-19328

CVE-2019-19328 affects the Wikibase Wikidata Query Service GUI, specifically the file ui/editor/tooltip/Rdf.js. The vulnerability exists in versions prior to 0.3.6-SNAPSHOT (2019-11-07) and permits HTML injection in entity tooltips, enabling an attacker to inject HTML content via tooltips. The no...