sidekiq: XSS via the queue name of the live-poll feature

A cross-site scripting vulnerability was found in sidekiq via the queue name of the live-poll feature. A potential attacker can impersonate or masquerade as the victim user using this vulnerability when Internet Explorer is used...

The vulnerability of the Internet Explorer browser, related to the use of memory after it is freed, allows a hacker to execute arbitrary code.

The vulnerability of the Internet Explorer browser is related to the use of memory after it is freed during the processing of objects in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created malicious web page...

The vulnerability in the CDisplayPointer class implementation of the Microsoft Internet Explorer browser allows a perpetrator to execute arbitrary code or cause a service failure.

The vulnerability of the CDisplayPointer class implementation in Microsoft Internet Explorer is related to resource management errors. Exploiting this vulnerability can allow an attacker to execute arbitrary code or cause a service failure through a specially created malicious web page...

The vulnerability of the CMshtmlEd::Exec function (mshtml.dll) in the Internet Explorer browser allows a hacker to execute arbitrary code.

The vulnerability of the CMshtmlEd::Exec function mshtml.dll in the Internet Explorer browser is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Microsoft Internet Explorer Installed

Binary data microsoftinternetexplorerinstalled.nbin...

CVE-2022-30118

Title for CVE: XSS in /dashboard/system/express/entities/forms/savecontrol/GUID: old browsers only.Description: When using Internet Explorer with the XSS protection disabled, editing a form control in an express entities form for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 can...

CVE-2022-30119

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-da...

CVE-2022-30119

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-da...

Design/Logic Flaw

Title for CVE: XSS in /dashboard/system/express/entities/forms/savecontrol/GUID: old browsers only.Description: When using Internet Explorer with the XSS protection disabled, editing a form control in an express entities form for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 can...

Design/Logic Flaw

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-da...

CVE-2022-30118

CVE-2022-30118 involves Cross‑Site Scripting in PortlandLabs Concrete CMS. The vulnerability lies in the /dashboard/system/express/entities/forms/save_control/[GUID] path where old browsers, specifically Internet Explorer with XSS protection disabled, can edit a form control in Concrete 8.5.7 and...

CVE-2022-30118

Title for CVE: XSS in /dashboard/system/express/entities/forms/savecontrol/GUID: old browsers only.Description: When using Internet Explorer with the XSS protection disabled, editing a form control in an express entities form for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 can...

CVE-2022-30119

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-da...

CVE-2022-30119

The CVE-2022-30119 entry concerns a Cross-Site Scripting (XSS) vulnerability in Concrete CMS, specifically in the /dashboard/reports/logs/view path. The vulnerability arises from insufficient sanitization/output of built URLs, enabling XSS on older browsers when Internet Explorer XSS protection i...

CVE-2022-30119

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-da...

RIG Exploit Kit Now Infects Victims' PCs With Dridex Instead of Raccoon Stealer

The operators behind the Rig Exploit Kit have swapped the Raccoon Stealer malware for the Dridex financial trojan as part of an ongoing campaign that commenced in January 2022. The switch in modus operandi, spotted by Romanian company Bitdefender, comes in the wake of Raccoon Stealer temporarily...

The Ghost of Internet Explorer Will Haunt the Web for Years

Microsoft's legacy browser may be dead—but its remnants are not going anywhere, and neither are its lingering security risks...

It’s official, today you can say goodbye to Internet Explorer. Or can you?

Today, the Internet Explorer IE 11 desktop application goes out of support and will be retired for certain versions of Windows 10. The retirement consists of two phases. During the first phase—the redirection phase—devices will be progressively redirected from IE to Microsoft Edge over the...

Microsoft Patch Tuesday, June 2022 Edition

Microsoft on Tuesday released software updates to fix 60 security vulnerabilities in its Windows operating systems and other software, including a zero-day flaw in all supported Microsoft Office versions on all flavors of Windows thats seen active exploitation for at least two months now. On a...

Patch Tuesday - June 2022

June's Patch Tuesday sees Microsoft releasing fixes for over 60 CVEs. Top of mind for many administrators this month is CVE-2022-30190, also known as Follina, which was observed being exploited in the wild at the end of May. Microsoft provided mitigation instructions disabling the MSDT URL protoc...