CVE-2018-20448

Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI...

CVE-2018-20448: Improper Neutralization of Input During Web Page Generation

Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI...

PT-2018-15384

Name of the Vulnerable Software and Affected Versions Frog CMS version 0.9.5 Description The issue allows for XSS via the Database name field to the "/install/index.php" API endpoint. Recommendations For Frog CMS version 0.9.5, update to a version that fixes this issue, as using the Database name...

BruteX v1.9 - Automatically Brute Force All Services Running On A Target

Automatically brute force all services running on a target Open ports Usernames Passwords INSTALL: ./install.sh USAGE: brutex target DOCKER: docker build -t brutex . docker run -it brutex target DEMO VIDEO: Download BruteX...

FreeBSD : typo3 -- multiple vulnerabilities (bab29816-ff93-11e8-b05b-00e04c1ea73d)

Typo3 core team reports : CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr. The vulnerability stemmed from the fact that it was possible to execute XSS inside the CKEditor source area after persuading the victim to: i switch CKEditor to source mode, then ii paste a...

Fedora Update for polkit FEDORA-2018-4ac3c68ee4

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for kernel-headers FEDORA-2018-a0914af224

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM DataPower Gateway is affected by a CSRF vulnerability (CVE-2018-1661)

Summary IBM DataPower Gateway has addressed the following vulnerability: CVE-2018-1661 Vulnerability Details CVEID: CVE-2018-1661 DESCRIPTION: IBM DataPower Gateways is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted...

Information Disclosure in Install Tool

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-010...

Security Misconfiguration in Install Tool Cookie

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-009...

Information Disclosure in Install Tool

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-010...

Security Misconfiguration in Install Tool Cookie

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-009...

Security Misconfiguration in Install Tool Cookie

It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool...

Information Disclosure in Install Tool

The Install Tool exposes the current TYPO3 version number to non-authenticated users...

typo3 -- multiple vulnerabilities

Typo3 core team reports: CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr. The vulnerability stemmed from the fact that it was possible to execute XSS inside the CKEditor source area after persuading the victim to: i switch CKEditor to source mode, then ii paste a...

Security Bulletin: IBM QRadar Network Security is affected by multiple openssl vulnerabilities.

Summary IBM QRadar Network Security has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious server during key agreement in a TL...

Google Android elevation of privilege vulnerability (CNVD-2019-01567)

Android is a free and open source Linux-based operating system led and developed by Google Inc. and the Open Handset Alliance. An arbitrary memory release vulnerability exists in the reallyinstallpackage of install.cpp in Google Android 7.0, 7.1.1, and 7.1.2. A local attacker can exploit this...

CVE-2018-9557

In reallyinstallpackage of install.cpp, there is a possible free of arbitrary memory due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0...

SUSE-SU-2018:3771-2 Security update for squid

This update for squid fixes the following issues: Security issues fixed: - CVE-2018-19131: Fixed Cross-Site-Scripting vulnerability in the TLS error handling bsc1113668. - CVE-2018-19132: Fixed small memory leak in processing of SNMP packets bsc1113669. Non-security issues fixed: - Create runtime...

PT-2018-19048

Name of the Vulnerable Software and Affected Versions Android versions 7.0 through 7.1.2 Description The issue is related to the really install package function in install.cpp, where uninitialized data can lead to the freeing of arbitrary memory. This could result in local escalation of privilege...