5994 matches found
Multiple vulnerabilities in Cybozu Garoon
Overview Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. CyVDB-1584CyVDB-2670 Operation restriction bypass vulnerability in Bulletin CWE-285 - CVE-2022-28718 CyVDB-1865CyVDB-2692 Operation restriction bypass vulnerability in Workflow CWE-285 - CVE-2022-27661...
Cross-site Scripting (XSS)
Overview katello is a package that adds Content and Subscription Management to Foreman Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Subscriptions component, due to insufficient organization name sanitization in SelectOrg/SetOrganization.js and...
GHSA-MHHC-R88H-2QRM katello Cross-site Scripting vulnerability
A cross-site scripting XSS flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to...
Anatomy of a Security Update
The Microsoft Security Response Center is part of the defender community and on the front line of security response for our customers and the company. Our mission is to protect customers and Microsoft from current and emerging threats related to security and privacy. We monitor threats and provid...
GHSA-QGJQ-M78X-4GM8 Improper Authentication in Jenkins Blue Ocean Plugin
Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. Its SCM content REST API supports the pipeline creation and editing feature in Blue...
Improper Authentication in Jenkins Blue Ocean Plugin
Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. Its SCM content REST API supports the pipeline creation and editing feature in Blue...
GHSA-RM5M-9MX4-G5R7 Improper Authentication in Jenkins Blue Ocean Plugin
Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when...
Improper Authentication in Jenkins Blue Ocean Plugin
Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when...
GHSA-6922-5V25-P8JG Moodle multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting XSS vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to 1 mod/scorm/player.php or 2...
Moodle multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting XSS vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to 1 mod/scorm/player.php or 2...
CVE-2021-43417
This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...
Denial Of Service (DoS)
RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...
CVE-2022-23724
Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials...
CVE-2019-16158
Fortinet FortiManager GUI contains an improper neutralization of input in the buffer parameter, enabling an authenticated attacker to perform an XSS attack. This vulnerability is documented in FG-IR-19-271 and is referenced in CNVD-2020-19918. No specific patch/version details are provided in the...
travismanion.org Cross Site Scripting vulnerability OBB-2562833
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-27925
Zimbra Collaboration aka ZCS 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal. Recent assessments: rbowes-r7 a...
CVE-2014-9511
Summary: CVE-2014-9511 maps to a WordPress vulnerability in the Sell Downloads plugin (versions ≤ 1.0.1). The issue arises from a lack of input sanitization, allowing an attacker to disclose arbitrary files on the server by accessing them through the web context. This can lead to exposure of serv...
CVE-2014-8814
The connected sources confirm a reflected XSS affecting the WordPress WP Photo Album Plus plugin up to version 5.4.17. The vulnerability allows injection of arbitrary JavaScript/HTML; remediation is to update the plugin to a non-vulnerable version.