63 matches found
Cross site scripting
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator...
U.S. Dept Of Defense: Reflected XSS in https://██████████ via "████████" parameter
Hello Security Team, I would like to report the XSS vulnerability on your system. The ██████████ parameter is not escaped properly for URL encoded values. ██████ Impact An XSS attack allows an attacker to execute arbitrary JavaScript in the context of the attacked website and the attacked user...
Template Injection
osm-static-maps is vulnerable to template injection. Lack of validation of user input into the template parameter tileserverUrl allows an attacker to inject arbitrary Javascript/HTML in a user's browser, perform requests on behalf of the user or read arbitrary local files...
What's New in Services and Support
Why Services and Support? Whether you are new to Akamai or increasing your adoption of our solutions, Services and Support is here to help you take on the most challenging problems businesses face today, so you can offer consistent, fast, secure experiences to your customers. It's no secret that...
perform-art.com Cross Site Scripting vulnerability OBB-1387098
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
The vulnerability of the MyJob.perform_later function in the Ruby on Rails software platform allows a perpetrator to gain unauthorized access to confidential data.
The vulnerability of the MyJob.performlater function in the Ruby on Rails software platform relates to the restoration of unreliable data structures in memory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to confidential data...
Cross site scripting
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an...
CVE-2018-20822
LibSass 3.5.4 allows attackers to cause a denial-of-service uncontrolled recursion in Sass::ComplexSelector::perform in ast.hpp and Sass::Inspect::operator in inspect.cpp...
CVE-2018-20822
LibSass 3.5.4 allows attackers to cause a denial-of-service uncontrolled recursion in Sass::ComplexSelector::perform in ast.hpp and Sass::Inspect::operator in inspect.cpp...
PT-2019-10261 · Sass +2 · Libsass +2
Name of the Vulnerable Software and Affected Versions: LibSass version 3.5.4 Description: The issue allows attackers to cause a denial-of-service due to uncontrolled recursion. This occurs in the Sass::Complex Selector::perform function in ast.hpp and the Sass::Inspect::operator in inspect.cpp...
CVE-2018-20822: Uncontrolled Recursion
LibSass 3.5.4 allows attackers to cause a denial-of-service uncontrolled recursion in Sass::ComplexSelector::perform in ast.hpp and Sass::Inspect::operator in inspect.cpp...
curl: Use of connection struct after free
A use-after-free flaw was found in libcurl. When invoking curleasyperform after cleaning up a multi session, an application can be tricked into using libcurl to connect to a malicious server, allowing an attacker to potentially execute arbitrary code. The highest threat from this vulnerability is...
Microsoft Windows 10: Perform volume maintenance tasks
This policy setting determines which users can perform volume or disk management tasks, such as defragmenting an existing volume, creating or removing volumes, and running the Disk Cleanup tool. Use caution when assigning this user right. Users with this user right can explore disks and extend...
CVE-2018-1000114: Incorrect Authorization
An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java that allow an attacker with read access to jobs to perform promotions...
IBM Security Guardium Database Activity Monitor Authorization Vulnerability
IBM Security Guardium Database Activity Monitor is a database activity monitor product from IBM USA. The product provides features such as automated controls for compliance and protection against internal and external threats. An authorization vulnerability exists in IBM Security Guardium Databas...
PT-2018-4177
Name of the Vulnerable Software and Affected Versions echor version 0.1.6 Description The issue allows local users to steal login credentials by monitoring the process table, specifically through the perform request function in the /lib/echor/backplane.rb file. Recommendations For version 0.1.6,...
perform-better.de XSS vulnerability
Vulnerable URL: http://www.perform-better.de/index.php?stoken=4AFF2C4Dsid=p9155llhb245kde1pk9babesl5〈=0=search=%22%2F%3E%27%3E%22%3EI%3Ci%3EI%3Csvg%2Fonload%3Dalert%28%2Fopenbugbounty%2F%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:|...
CVE-2017-2307
A reflected cross site scripting vulnerability in the administrative interface of Juniper Networks Junos Space versions prior to 16.1R1 may allow remote attackers to steal sensitive information or perform certain administrative actions on Junos Space...
PT-2018-4399
Name of the Vulnerable Software and Affected Versions wpa supplicant versions 2.x before 2.6 Description The issue allows remote attackers to cause a denial of service, resulting in a daemon crash, by sending an EAP-pwd Confirm message followed by the Identity exchange when EAP-pwd is enabled. Th...
Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2014-3103)
The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3103 advisory. - ALSA: control: Protect user controls against concurrent access Lars-Peter Clausen Orabug: 20192540 CVE-2014-4652 - target/rd: Refactor...