Feindura Cross-Site Scripting Vulnerability

feindura is a set of open source CMS Content Management System written in PHP. A cross-site scripting vulnerability exists in the index.php?category=0&page=new page in feindura version 2.0.7, which can be exploited by a remote attacker to execute malicious script in the browser with the help of t...

newmiltontowncouncil.gov.uk Improper Access Control vulnerability

Open Bug Bounty ID: OBB-675871 Description| Value ---|--- Affected Website:| newmiltontowncouncil.gov.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

realtyhop.com XSS vulnerability

Open Bug Bounty ID: OBB-675834 Description| Value ---|--- Affected Website:| realtyhop.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-16728

feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new...

CVE-2018-16728

feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new...

Design/Logic Flaw

feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new...

CVE-2018-16728

Feindura 2.0.7 contains a Cross-Site Scripting (XSS) vulnerability exposure in the tags field when creating a new page (index.php?category=0&page=new). This is documented across multiple feeds (NVD/CNVD/OSV etc.) and is specific to feindura 2.0.7. The underlying issue is an XSS entry that could a...

realtyhop.com XSS vulnerability

Open Bug Bounty ID: OBB-675388 Description| Value ---|--- Affected Website:| realtyhop.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

chromium-browser: Script injection in New Tab Page

Insufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension...

Qualys Policy Compliance Notification: Policy Library Update

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

CVE-2018-16770

In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service application crash or possibly have unspecified other impact because a certain newallocator allocate call fails...

Code injection

In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service application crash or possibly have unspecified other impact because a certain newallocator allocate call fails...

CVE-2018-16772

CVE-2018-16772 affects Hoosk v1.7.0. The vulnerability is a cross-site scripting (XSS) issue exploitable via the Navigation Title when creating a new page at admin/pages/new. The attack vector is user-facing via the web interface, with the underlying cause described as a navigation title handling...

Hoosk Cross-Site Scripting Vulnerability

Hoosk is a lightweight user-centered content management system CMS. The system has built-in Codelgniter for creating responsive websites. A cross-site scripting vulnerability exists in Hoosk 1.7.0, which can be exploited by an attacker via the navigation title of a new page entered at...

Design/Logic Flaw

ShowDoc v1.8.0 has XSS via a new page...

CVE-2018-16342

ShowDoc v1.8.0 has XSS via a new page...

CVE-2018-16342

ShowDoc v1.8.0 has XSS via a new page...

Friday Squid Blogging: Giant Squid Washes up on Wellington Beach

Another giant squid washed up on a beach, this time in Wellington, New Zealand. Is this a global trend? As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

I'm Doing a Reddit AMA

On Thursday, September 6, starting at 10:00 am CDT, I'll be doing a Reddit "Ask Me Anything" in association with the Ford Foundation. It's about my new book, but -- of course -- you can ask me anything. No promises that I will answer everything...

Kernel update: New kernel 2.6.32-042stab133.2; Virtuozzo 6.0 Update 12 Hotfix 32 (6.0.12-3719)

This update provides a new kernel 2.6.32-042stab133.2 for Virtuozzo 6.0. The new kernel introduces a stability fix. Vulnerability id: PSBM-87976, OVZ-7048, OVZ-7049 Regression in 2.6.32-042stab133.1: Host could crash during processing of quite rare fragmented TCP traffic...