520 matches found
GHSA-C6RP-XVQV-MWMF Cross-site Scripting in epubjs
managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS...
CVE-2021-33040
managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS...
CVE-2021-33040
managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS...
Cross site scripting
managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS...
CVE-2021-33040
managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS...
CVE-2021-33040
CVE-2021-33040 affects FuturePress EPub.js (prior to v0.3.89). The vulnerability is a XSS in managers/views/iframe.js due to insufficient escaping of user-submitted data. Used in the EPUB rendering library; impact is cross-site scripting. Public references indicate the fix is in v0.3.89 (upstream...
Threat Advisory: E-commerce Bots Use Domain Registration Services for Mass Account Fraud
While researching a recent large-scale bot campaign with CQ Prime Threat Research team lead, Dean Lendrum, we found attackers using domain parking and monetization services to register multiple domains, creating a large number of fake eCommerce accounts per domain. TL; DR ------ Analysis of...
CVE-2021-35244
The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution...
CVE-2021-42775
Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a vulnerability in the remote firmware download feature that could allow a user to place or replace an arbitrary file on the remote host. In...
We’re Excited to Announce the Launch of Comms Hub!
We are excited to announce the launch of Comms Hub to the Researcher Portal submission experience! With this launch, security researchers will be able to streamline communication with MSRC case SPMs case managers, attach additional files, track case and bug bounty status all in the Researcher...
Oracle Auditing Part 2: Mandatory and Fine-Grained Auditing
This is the second of three articles on the topic of Oracle auditing. It is relevant to Oracle 10g, 11g, and 12c, although Unified Auditing in 12c makes some of this content irrelevant if you choose to use Pure Unified Auditing. Unified Auditing will be covered in the third part of this series an...
ALBA-2021:2598 resource-agents bug fix and enhancement update
The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability HA environment. Bug Fixes and Enhancements: aws-vpc-move-ip: Enable eni lookup for AWS shared networks v...
GHSA-2F88-5HG8-9X2X Origin Validation Error in Apache Maven
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model pom which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository...
GHSA-4MG4-WVMX-5332 Server-Side Request Forgery in Plone
Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...
Incorrect Permission Assignment for Critical Resource in Plone
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...
GHSA-HM2P-FHWX-9285 Incorrect Permission Assignment for Critical Resource in Plone
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...
CVE-2021-33509
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...
PYSEC-2021-82
Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...