17005 matches found
Jenkins dingding-notifications Cleartext Storage of Credentials Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of Jenkins. Authentication is required to exploit this vulnerability. The specific flaw exists within the dingding-notifications plugin. The issue results from storing credentials in plaintext. A...
LimeSurvey < 3.17.14 Multiple Vulnerabilities
LimeSurvey is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PrivExchange - Exchange Your Privileges For Domain Admin Privs By Abusing Exchange
POC tools accompanying the blog Abusing Exchange: One API call away from Domain Admin. Requirements These tools require impacket. You can install it from pip with pip install impacket, but it is recommended to use the latest version from GitHub. privexchange.py This tool simply logs in on Exchang...
How to sign up for FLASHes and SECURITY bulletins
Summary Receiving FLASHES and SECURITY BULLETINS is important to keep up with critical changes Steps How to sign up for product FLASH notifications: http://www-01.ibm.com/software/support/einfo.html Security portal for security/integrity announcements:...
Limesurvey User Notification Flagging Vulnerability
limesurvey is an open source online questionnaire program with multiple functions such as questionnaire design, modification, release, recovery and statistics. A user notification marking vulnerability exists in Limesurvey versions prior to 3.17.14. An attacker can use this vulnerability to mark...
CVE-2019-16181
In Limesurvey before 3.17.14, admin users can mark other users' notifications as read...
Code injection
In Limesurvey before 3.17.14, admin users can mark other users' notifications as read...
CVE-2019-16181
CVE-2019-16181 affects LimeSurvey prior to 3.17.14, where admin users can mark other users’ notifications as read. The Red Hat/NVD/OpenVAS records corroborate the same issue across multiple feeds. The vulnerability is documented with a low CVSS 3.1 base score (2.7) in NVD, indicating limited impa...
CVE-2019-16181
In Limesurvey before 3.17.14, admin users can mark other users' notifications as read...
CVE-2019-11544
An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It allows Information Disclosure. Non-member users who subscribe to notifications of an internal project with issue and repository...
CVE-2019-11544
Removed by vendor...
Gamification Can Transform Company Cybersecurity Culture
Chief information security officers CISOs of Global 2000 enterprises have one of the toughest jobs in the world, defending their organization’s cyberspace and being the guardian of its assets and private information. But CISOs also have a second, even bigger problem: Their own company employees...
WordPress onesignal-free-web-push-notifications plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. onesignal-free-web-push-notifications is a plugin used to push notifications to site visitors. A cross-site scripting vulnerability...
CVE-2019-15827
The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter...
CVE-2019-15827
The CVE-2019-15827 entry affects the WordPress plugin onesignal-free-web-push-notifications, specifically versions before 1.17.8. The vulnerability is an XSS via the subdomain parameter (POST or input handling) that can lead to client-side script execution within the context of an affected site. ...
Scientific Linux Security Update : kde-workspace on SL7.x x86_64 (20190806)
Security Fixes : - kde-workspace: Missing sanitization of notifications allows to leak client IP address via IMG element CVE-2018-6790 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128224; scriptversion"1.4";...
August 17, 2019—KB4512534 (OS Build 17763.720)
None None...
Nextcloud: Username and Access Token Disclousure
Versions ===================== Nextcloud Server Version: 16.0.3.0 it.tsweb.Nextcloud iOS App Version: 2.23.7 Description ===================== While logging in to an owncloud instance the iOS client sends the Username and password to the ressource /login?redirecturl=/login/flow/grant and recieves...