CVE-2018-12246

CVE-2018-12246 affects Symantec Web Isolation (WI) version 1.11 (prior to 1.11.21). The vulnerability is a reflected cross-site scripting (XSS) that allows an attacker to trick end users protected by WI into visiting a crafted URL, causing malicious JavaScript to run in the user’s browser within ...

CVE-2018-12246: Improper Neutralization of Input During Web Page Generation

Symantec Web Isolation WI 1.11 prior to 1.11.21 is susceptible to a reflected cross-site scripting XSS vulnerability. A remote attacker can target end users protected by WI with social engineering attacks using crafted URLs for legitimate web sites. A successful attack allows injecting malicious...

Web Isolation vulnerable to cross-site scripting

Overview Web Isolation provided by Symantec Corporation contains a reflected cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update the software to the latest version according to the information provide...

Symantec Web Isolation Cross-Site Scripting Attack Vulnerability

Symantec Web Isolation is a Web security protection software from Symantec USA. The software is mainly used to prevent malware and phishing attacks, etc. A cross-site scripting vulnerability exists in Symantec Web Isolation version 1.11. A remote attacker can exploit this vulnerability to execute...

JVN#58005743: Web Isolation vulnerable to cross-site scripting

Web Isolation provided by Symantec Corporation contains a reflected cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update the software to the latest version according to the information provided by the...

Reflected XSS Vulnerability in Web Isolation

SUMMARY Symantec Web Isolation WI is susceptible to a reflected cross-site scripting XSS vulnerability. A remote attacker can target end users protected by WI with social engineering attacks using crafted URLs for legitimate web sites. A successful attack allows injecting malicious JavaScript cod...

PT-2018-1937

Name of the Vulnerable Software and Affected Versions Symantec Web Isolation WI versions 1.11 through 1.11.20 Description The issue allows a remote attacker to target end users with social engineering attacks using crafted URLs for legitimate websites, potentially injecting malicious JavaScript...

NUUO NVRmini2 and NVRsolo

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit/public exploits are available Vendor: NUUO Equipment: NVRmini2, NVRsolo Vulnerabilities: Stack-based Buffer Overflow, Leftover Debug Code 2. RISK EVALUATION Successful exploitation of these...

Authentication Bypass

github.com/gardener/gardener is vulnerable to authentication bypass attacks. The vulnerability exists due to the combined issues with kube-apiserver, and a missing cleanup to isolate network resources, and potentially allows exploitation in the Gardener context...

CVE-2018-2475

Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot cluster resides in the corresponding seed cluster. Due to missing network isolation a shoot's apiserver can access services/endpoints in the private network of its corresponding seed cluster. Combined with...

CVE-2018-2475

Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot cluster resides in the corresponding seed cluster. Due to missing network isolation a shoot's apiserver can access services/endpoints in the private network of its corresponding seed cluster. Combined with...

Code injection

Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot cluster resides in the corresponding seed cluster. Due to missing network isolation a shoot's apiserver can access services/endpoints in the private network of its corresponding seed cluster. Combined with...

CVE-2018-2475

Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot cluster resides in the corresponding seed cluster. Due to missing network isolation a shoot's apiserver can access services/endpoints in the private network of its corresponding seed cluster. Combined with...

CVE-2018-2475

The CVE describes a Gardener-specific issue where the Kubernetes apiserver of a shoot cluster resides in the seed cluster, and due to missing network isolation the shoot’s apiserver can access services in the seed’s private network. This could, in theory, enable compromise of other shoot or seed ...

CVE-2018-2475

Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot cluster resides in the corresponding seed cluster. Due to missing network isolation a shoot's apiserver can access services/endpoints in the private network of its corresponding seed cluster. Combined with...

PT-2018-15591

Name of the Vulnerable Software and Affected Versions Gardener versions prior to 0.12.4 Description The issue arises from missing network isolation in the Gardener architecture, allowing a shoot's apiserver to access services or endpoints in the private network of its corresponding seed cluster...

CVE-2018-2475: Undefined Security Weakness

Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot cluster resides in the corresponding seed cluster. Due to missing network isolation a shoot's apiserver can access services/endpoints in the private network of its corresponding seed cluster. Combined with...

Siemens SIMATIC S7-1200 CPU Family Version 4

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely Vendor: Siemens Equipment: SIMATIC S7-1200 CPU Family Version 4 Vulnerability: Cross-Site Request Forgery CSRF 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a CSRF attack if an unsuspecting user is...

Fuji Electric V-Server Lite

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Fuji Electric Equipment: V-Server Lite Vulnerability: Classic Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote attacker to view sensitive...

chromium-browser: Site Isolation bypass after tab restore

Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML page...