At a New York Privacy Pop-Up, Facebook Sells Itself

The one-day pop-up kiosk is meant to show that Facebook takes users’ privacy concerns seriously. It also was an opportunity to gather more data...

FUEL CMS Cross-Site Scripting Vulnerability (CNVD-2019-07076)

FUEL CMS is a content management system based on CodeIgniter. A cross-site scripting vulnerability exists in FUEL CMS 1.4.3, which can be exploited by an attacker to conduct a cross-site scripting attack via a title or body text in a layout variable during new page creation...

CVE-2018-19118

Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service stack-based buffer overflow via the 'Domain Name' field when adding a new domain...

Cross site scripting

XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI...

CVE-2018-20136

CVE-2018-20136 affects FUEL CMS 1.4.3, where an XSS flaw exists in the Header or Body within Layout Variables during new-page creation (demonstrated via pages/edit/1?lang=english). The root cause is input reflected in layout variables, enabling script injection. Impact is cross-site scripting; ex...

CVE-2018-20136

XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI...

New Relic: The impossibility of inclusion of the trial (BROWSER)

Hello! Found a problem that reveals a query in the newrelic database in connection with receiving a server error on a normal domain https://rpm.newrelic.com/browser/id this is not! The problem is that I can't run the trial version through the EU. Getting 500-server message: "Internal Server Error...

Description of the security update for SharePoint Enterprise Server 2016: December 11, 2018

None None...

[SECURITY] Fedora 29 Update: uriparser-0.9.0-1.fc29

Uriparser is a strictly RFC 3986 compliant URI parsing library written in C. uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license...

[SECURITY] Fedora 28 Update: uriparser-0.9.0-1.fc28

Uriparser is a strictly RFC 3986 compliant URI parsing library written in C. uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license...

New Relic: [NR Insights] IDOR - Modify the filter settings for any NR Insights dashboard through internal_api endpoint

An IDOR exists allowing me to change the filter settings of any account on New Relic through the following PUT request: PUT /internalapi/1/accounts/1523936/dashboards/687944/filter HTTP/1.1 Host: insights.newrelic.com User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.14; rv:63.0 Gecko/20100101...

new-energy-bracelet.com XSS vulnerability

Open Bug Bounty ID: OBB-707426 Description| Value ---|--- Affected Website:| new-energy-bracelet.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

Xorg X11 Server (AIX) - Local Privilege Escalation

Xorg X11 Server AIX - Local Privilege Escalation Exploit Title: AIX Xorg X11 Server - Local Privilege Escalation Date: 29/11/2018 Exploit Author: @0xdono Original Discovery and Exploit: Narendra Shinde Vendor Homepage: https://www.x.org/ Platform: AIX Version: X Window System Version 7.1.1 Filese...

UBUNTU-CVE-2018-16862

A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation removal. The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one...

New Relic: Upgrade menu exposes the mobile application token meant to only be visible to administrators

Usually, the restricted user is not able to view the mobile application token for a mobile app - the page that this token is visible on is only accessible to administrators. However - there exists a workaround to this if you are a restricted user and you still want to obtain this token - simply...

QSC18 Takeaway: Complex Environments Demand Visibility and Real-Time Security

If there were two important takeaways from this year's Qualys Security Conference year they would be how today’s complex hybrid environments are demanding security teams find ways to increase visibility into the state of their security posture and be able to quickly mitigate new risks as they...

CVE-2018-19332

An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI...

CVE-2018-19332

An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI...

With The NASDAQ Bell Ceremony, We Kick Off The Next Leg of Imperva’s Incredible Journey

On Friday morning our CEO Chris Hylen and company execs rung the NASDAQ opening bell in New York, welcoming another day of trading for the world’s second-largest stock exchange; and taking full advantage of the opportunity to celebrate recent corporate milestones for Imperva. “I’m honored to be...

Nagios XI elevation of privilege vulnerability (CNVD-2018-23141)

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. An elevation of privilege vulnerability exists in Nagios XI 5.5.6. A locally authenticated attacker can exploit this vulnerability to...