UBUNTU-CVE-2020-7746

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deeply merged with provided options. However, during this operation, the keys of the object being...

CVE-2020-7746

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deeply merged with provided options. However, during this operation, the keys of the object being...

CVE-2020-7746

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deeply merged with provided options. However, during this operation, the keys of the object being...

Cross-site Scripting (XSS)

github.com/grafana/grafana is vulnerable to cross-site scripting XSS. The vulnerability exists when specifying series alias such as test data or elastic search, which allows special characters, caused by the bs-typeahead directive that evals the select options passed to it...

SRC-2021-0018 : Microsoft SharePoint Server OAuth Authorization Code Leak Elevation of Privilege Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to elevate privileges. User interaction is required required to exploit this vulnerability. The specific flaw exists in the oauthauthorize page. The issue results from a missing X-Frame-Options header when performing an authorizati...

PT-2020-6799 · Chart.Js · Chartjs

Name of the Vulnerable Software and Affected Versions: chart.js versions prior to 2.9.4 Description: The issue is related to the options parameter not being properly sanitized when processed. This leads to a prototype pollution when the existing options or default options are deeply merged with...

Mailman 1.x > 2.1.23 - Cross Site Scripting (XSS)

Title: Mailman 1.x 2.1.23 - Cross Site Scripting XSS Type: Reflected XSS Software: Mailman Version: =1.x = 2.1.23 Vendor Homepage: https://www.list.org Original link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5950 POC Author: Valerio Alessandroni Date: 28/10/2020 Description:...

Recommended update for mailman (moderate)

openSUSE Security Update: Recommended update for mailman Announcement ID: openSUSE-SU-2020:1752-1 Rating: moderate References: 1171363 1173369 Cross-References: CVE-2020-12108 CVE-2020-12137 CVE-2020-15011 Affected Products: openSUSE Backports SLE-15-SP2 An update that fixes three vulnerabilities...

Microsoft IE Browser Death March Hastens

As the death of the once dominant Internet Explorer IE draws closer, Microsoft is quickly pounding more nails into the browser’s coffin. On Monday, Microsoft hastened its IE-to-Edge browser-transition strategy and announced new controls for users and IT staff when it comes to how the lame-duck...

Scientific Linux Security Update : firefox on SL7.x x86_64 (20201001)

Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3 CVE-2020-15673 - Mozilla: Integer overflow in nsJPEGEncoder::emptyOutputBuffer CVE-2020-12422 - Mozilla: X-Frame-Options bypass using object or embed tags CVE-2020-15648 - Mozilla: Bypassing iframe sandbox whe...

How to Configure ICA Session Timeout Values for Access Gateway Enterprise Edition Sessions

This article describes how to configure different ICA session timeout values for the same ICA-published resource when Access Gateway Enterprise Edition is using secure gateway proxy mode. This involves creating an additional ICA listener on each XenApp server, modifying the terminal server settin...

VulnCheck KEV: CVE-2020-36725

The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the 'ti-woocommerce-wishlist/includes/export.class.php' file. This makes it possible for authenticated...

WordPress TI WooCommerce Wishlist plugin <= 1.21.11 - Authenticated WP Options Change vulnerability

Authenticated WP Options Change vulnerability found by Jerome Bruandet NinTechNet in WordPress TI WooCommerce Wishlist plugin versions = 1.21.11. Solution Update the WordPress TI WooCommerce Wishlist plugin to the latest available version at least 1.21.12...

WordPress TI WooCommerce Wishlist Premium plugin <= 1.21.4 - Authenticated WP Options Change vulnerability

Authenticated WP Options Change vulnerability found by Jerome Bruandet NinTechNet in WordPress TI WooCommerce Wishlist Premium plugin versions = 1.21.4. Solution Update the WordPress TI WooCommerce Wishlist Premium plugin to the latest available version at least 1.21.5...

CVE-2020-15793

A vulnerability has been identified in Desigo Insight All versions. The device does not properly set the X-Frame-Options HTTP Header which makes it vulnerable to Clickjacking attacks. This could allow an unauthenticated attacker to retrieve or modify data in the context of a legitimate user by...

CVE-2020-15793

A vulnerability has been identified in Desigo Insight All versions. The device does not properly set the X-Frame-Options HTTP Header which makes it vulnerable to Clickjacking attacks. This could allow an unauthenticated attacker to retrieve or modify data in the context of a legitimate user by...

Remote Code Execution (RCE)

git-stats is vulnerable to remote code execution RCE. The vulnerability exists through the unsanitized values of options.start and options.end used in an exec call in GitStats.prototype.authors...

Quick Chat <= 4.14 - Authenticated Stored Cross-Site Scripting

An Authenticated Persistent XSS vulnerability is present in the the plugin options page /wp-admin/options-general.php?page=quick-chat/quick-chat.php, vulnerable fields: «Chat name prefix for guest users», «Advertisement code for your AdSense». PoC The PoC will be displayed once the issue has been...

Sensitive data exposure in NATS

Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials. The connection configuration options in these JavaScript-based implementations were...

Important: Red Hat Security Advisory: firefox security and bug fix update

An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...