CVE-2019-19001

For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an attacker can frame parts of the application on a malicious web site, revealing sensitive user information such as authentication credentia...

CVE-2019-19089 eSOMS: X-Content-Type-Options Header Missing

For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted and displayed as different content type other than declared. A possible attack scenario would be unauthorized code execution via text...

Command Injection

Amendment This was deemed not a vulnerability. Overview effect is a node package that allows you to add effects on images. Affected versions of this package are vulnerable to Command Injection. The argument options can be controlled by users without any sanitization. PoC js var Root=...

Command Injection

Overview install-package is a package that installs node modules from JavaScript. Affected versions of this package are vulnerable to Command Injection. The argument options can be controlled by users without any sanitization. PoC var root = require"install-package"; root"", "& touch Song"; Detai...

theodorfontane.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1127623 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting theodorfontane.com websit...

Kubernetes: Clickjacking

Report Submission Form Summary: Clickjacking is an attack that tricks a user into clicking a webpage element which is invisible or disguised as another element Description: Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user...

Samsung Mobile Device Authorization Issue Vulnerability (CNVD-2020-34737)

Android is a free and open source operating system from Google based on the Linux kernel without GNU components. Samsung mobile devices have an authorization issue vulnerability that can be exploited by attackers to access developer options...

CVE-2019-20532

An issue was discovered on Samsung mobile devices with O8.x, P9.0, and Q10.0 software. Attackers can access the Developer options without authentication. The Samsung ID is SVE-2019-15800 December 2019...

Authentication flaw

An issue was discovered on Samsung mobile devices with O8.x, P9.0, and Q10.0 software. Attackers can access the Developer options without authentication. The Samsung ID is SVE-2019-15800 December 2019...

CVE-2019-20532

An issue was discovered on Samsung mobile devices with O8.x, P9.0, and Q10.0 software. Attackers can access the Developer options without authentication. The Samsung ID is SVE-2019-15800 December 2019...

Cross-Site Scripting (XSS)

github.com/gogs/gogs is vulnerable to cross-site scripting XSS. The x-content-type-options header value is not configured to nosniff, which causes the user's browser to perform mime-type sniffing when viewing a raw file. This can lead to arbitrary execution of Javascript in a raw file...

Security Bulletin: WebSphere Message Broker / IBM Integration Bus WEBUI does not set X-FRAME-OPTIONS (CVE-2016-9010)

Summary WebSphere Message Broker / IBM Integration Bus WEBUI does not set X-FRAME-OPTIONS Vulnerability Details CVEID: CVE-2016-9010 DESCRIPTION: IBM WebSphere Message Broker could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious web...

Option to Install Veeam ONE Agent is Unavailable (Greyed Out)

Challenge When attempting to install the Veeam ONE Agent on a Veeam Backup Server, theInstall agent option is unavailable and greyed out. Cause There are several possible causes for this issue: The Veeam ONE Agent is already installed on the Veeam Backup & Replication Server. The Veeam ONE Server...

5 Best Internet Service Locators

By Waqas By using an internet service locator will allow you to learn about all of your options for service providers before you commit to a company. This is a post from HackRead.com Read the original post: 5 Best Internet Service Locators...

phpMyAdmin -- SQL injection

phpMyAdmin Team reports: PMASA-2020-2 SQL injection vulnerability in the user accounts page, particularly when changing a password PMASA-2020-3 SQL injection vulnerability relating to the search feature PMASA-2020-4 SQL injection and XSS having to do with displaying results Removing of the...

openSUSE Security Update : salt (openSUSE-2020-357)

This update for salt fixes the following issues : - Avoid possible user escalation upgrading salt-master bsc1157465 CVE-2019-18897 - Fix unit tests failures in testbatchasync tests - Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU...

gulp-styledocco injection vulnerability

gulp-styledocco is a package for generating documentation from stylesheets and style guide documentation. A security vulnerability exists in gulp-styledocco 0.0.3 and earlier versions, which stems from the program failing to clean up the 'options' parameter. An attacker can exploit this...

closure-compiler-stream injection vulnerability

closure-compiler-stream is a stream interface to a closure compiler. A security vulnerability exists in closure-compiler-stream version 0.1.15 and earlier, which stems from the program failing to perform any cleanup operations on the user-controllable 'options' parameter. An attacker could use th...

SUSE SLED15 / SLES15 Security Update : salt (SUSE-SU-2020:0684-1)

This update for salt fixes the following issues : Avoid possible user escalation upgrading salt-master bsc1157465 CVE-2019-18897 Fix unit tests failures in testbatchasync tests Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU...

CVE-2020-7603

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization...