Node.js third-party modules: [fileview] Inadequate Output Encoding and Escaping

I would like to report stored xss in fileview module It allows an attacker to embed malicious js code in filename there was no sanitization performed. Module module name:fileview version: 0.1.6 npm page: https://www.npmjs.com/package/fileview Module Description File browsers on web. It's easy to...

Critical WinRAR Flaw Found Actively Being Exploited

A critical 19-year-old WinRAR vulnerability disclosed last week has now been spotted actively being exploited in a spam campaign spreading malware. The campaign, discovered by researchers with 360 Threat Intelligence Center, takes advantage of a path-traversal WinRAR vulnerability, which could...

CVE-2018-16887

A cross-site scripting XSS flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to...

CVE-2018-16887

A cross-site scripting XSS flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to...

Cross site scripting

A cross-site scripting XSS flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to...

CVE-2018-16887

A cross-site scripting XSS flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to...

CVE-2018-16861

A cross-site scripting XSS flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and...

CVE-2018-16861

A cross-site scripting XSS flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and...

PT-2018-13777

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.18.3 Foreman versions prior to 1.19.1 Foreman versions prior to 1.20.0 Description A cross-site scripting XSS flaw was found in the foreman component of satellite. An attacker with privilege to create entries using...

CVE-2018-16861: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and...

razorCMS HTML Injection Vulnerability

razorCMS is an open source content management system written in PHP, which stores all data in flat files, so there is no need to install a database. An HTML injection vulnerability exists in razorCMS version 3.4.7, which can be exploited by attackers to execute malicious code...

CVE-2018-14620: Download of Code Without Integrity Check

The OpenStack RabbitMQ container image insecurely retrieves the rabbitmqclusterer component over HTTP during the build stage. This could potentially allow an attacker to serve malicious code to the image builder and install in the resultant container image. Version of openstack-rabbitmq-container...

DLL Hijacking Vulnerability in GE iFix scu.exe Component

GE Intelligent Platforms' GE-IP iFIX is the world's leading industrial automation software solution that provides process visualization, data acquisition and data monitoring of manufacturing operations. A DLL hijacking vulnerability exists in the GE iFix scu.exe component, which can be exploited ...

CVE-2018-10604

SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within the Compass installation folder, resulting in escalation of privilege and/or malicious code execution...

CVE-2018-10604

CVE-2018-10604 affects SEL Compass 3.0.5.1 and earlier, where incorrect default permissions grant all users full access to the Compass directory, enabling modification or overwriting of files and potential privilege escalation or code execution. The issue is documented across multiple sources (NV...

CVE-2018-10604: Incorrect Default Permissions

SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within the Compass installation folder, resulting in escalation of privilege and/or malicious code execution...

PT-2018-9995

Name of the Vulnerable Software and Affected Versions: SEL Compass versions 3.0.5.1 and prior Description: The issue allows all users full access to the SEL Compass directory, which may enable modification or overwriting of files within the Compass installation folder. This could result in...

Multiple Echelon Products Information Disclosure Vulnerability (CNVD-2018-18306)

Echelon SmartServer 1 and others are products of Echelon Corporation of the United States. echelon SmartServer 1 is a multifunctional controller, which supports building automation control and enterprise energy management, etc. i.LON 100 is a network server, which is mainly used to configure and...

CVE-2018-10631: Protection Mechanism Failure

The 8840 Clinician Programmer executes the application program from the 8870 Application Card. An attacker with physical access to an 8870 Application Card and sufficient technical capability can modify the contents of this card, including the binary executables. If modified to bypass protection...

CVE-2018-12333

CVE-2018-12333 affects ECOS Secure Boot Stick (SBS) version 5.6.5 and is caused by insufficient verification of data authenticity. The vulnerability could allow an attacker to manipulate security-related configurations and execute malicious code on the device. Publicly documented details identify...