4623 matches found
Security Bulletin: Vulnerabilities in OpenSSL affect IBM Integration Bus and IBM App Connect Enterprise (CVE-2019-1551)
Summary Vulnerabilities in OpenSSL affect IBM Integration Bus and IBM App Connect Enterprise . The DataDirect ODBC Drivers and level of node js used by IBM App Connect Enterprise and IBM Integration Bus have addressed the applicable CVEs Vulnerability Details CVEID: CVE-2019-1551 DESCRIPTION:...
Payment Card Skimmer Group Using Raccoon Info-Stealer to Siphon Off Data
A cybercrime group known for targeting e-commerce websites unleashed a "multi-stage malicious campaign" earlier this year designed with an intent to distribute information stealers and JavaScript-based payment skimmers. In a new report published today and shared with The Hacker News,...
[ASA-202012-1] python-lxml: cross-site scripting
Arch Linux Security Advisory ASA-202012-1 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-27783 Package : python-lxml Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1319 Summary ======= The package python-lxml befo...
Command Injection
Overview spritesheet-js is a command-line spritesheet a.k.a. Texture Atlas generator written in node.js. Affected versions of this package are vulnerable to Command Injection. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which...
CVE-2020-27783
A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code...
CVE-2020-27783
The CVE-2020-27783 issue is a XSS vulnerability in python-lxml's HTML Cleaner. The Cleaner’s parser did not sufficiently emulate browsers, causing mismatches between sanitization and the rendered page. This can allow a remote attacker to run arbitrary HTML/JS in a victim’s browser. Affected produ...
CVE-2020-27783
A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code...
CVE-2020-27783
A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code...
CVE-2020-27783
A Cross-site Scripting XSS vulnerability was found in the python-lxml's clean module. The module's parser did not properly imitate browsers, causing different behaviors between the sanitizer and the user's page. This flaw allows a remote attacker to run arbitrary HTML/JS code. The highest threat...
Glassdoor: Reflected XSS at https://www.glassdoor.com/ via the 'numSuggestions' parameter
Hi there, I have found the xss vulnerability at: https://www.glassdoor.com/ via parameter: numSuggestions Summary: Affected Parameter: numSuggestions Browsers tested: Firefox, Chrome, Edge latest version Steps To Reproduce: Go to:...
Stored XSS by authenticated backend user with access to upload files
Impact Backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by browsers, this means that they could theoretically upload Javascript that would be executed on a path under t...
AZL-32281 CVE-2020-8277 affecting package python-gevent for versions less than 21.1.2-3
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions 15.2.1, 14.15.1, and 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and...
Google Firebase Js Sdk prototype contamination vulnerability
Google Firebase Js Sdk is a client-side code base for connecting to the Firebase backend service from Google. firebase/util versions prior to 0.3.4 contain a prototype contamination vulnerability that originates from the deepExtend function in DeepCopy.ts. An attacker could exploit this...
Debian: Security Advisory (DSA-4789-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DSA-4789-1 : codemirror-js - security update
It was discovered that codemirror, a browser-based text editor implemented in JavaScript, was vulnerable to regular expression denial-of-service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4789. The text...
Prototype Pollution in json-logic-js
Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through the method property name. This causes modification of any existing property that will exist on all objects and leads to Remote Cod...
GHSA-M9HW-7XFV-WQG7 Prototype Pollution in json-logic-js
Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through the method property name. This causes modification of any existing property that will exist on all objects and leads to Remote Cod...
[SECURITY] [DSA 4789-1] codemirror-js security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4789-1 [email protected] https://www.debian.org/security/ Sebastien Delafond November 12, 2020 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4789-1] codemirror-js security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4789-1 [email protected] https://www.debian.org/security/ Sebastien Delafond November 12, 2020 https://www.debian.org/security/faq -...