Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 Vaadin 10.0.0 through 10.0.13, and 1.1.0 through 1.4.2 Vaadin 11.0.0 through 13.0.5 allows attacker to execute malicious JavaScript via crafted URL. See CWE-81: Improper...

SQL injection vulnerability in pr***.php page of Jinan Yuxia Information Technology Co.

Jinan Yuxia Information Technology Co., Ltd. to the Internet products and related services as the main direction, is a collection of website construction and network promotion, IDC business, software development, server hosting, telecommunications value-added services and other integrated service...

Emerson HART SE4003S2B6 Analog Input Card Detection

Binary data 756779.prm...

Amid Bug Bounty Hype, Sometimes Security is Left in the Dust

In January, the European Union kicked-off over a dozen new bug bounty programs targeting a bevy of popular open-source programs used by its members. The effort was supposed to be met with cheers. But instead, the launch sparked an unexpected backlash from the security community. The EU’s program...

Cross-Site Scripting

Overview Versions of simple-markdown prior to 0.4.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing data or VBScript URIs and a...

SQL Injection Vulnerability in pr***.asp Page of E-Long Technology Website Builder System

Ningbo Yilong Olive Tree Computer Technology Co., Ltd. is a design and construction company specializing in corporate website platforms, government schools, home services and other industries. There is a SQL injection vulnerability in the pr.asp page of the website builder system of E-Dragon...

java-1.8.0-openjdk security update

1:1.8.0.201.b09-0 - Update to aarch64-shenandoah-jdk8u201-b09. - Resolves: rhbz1661577 1:1.8.0.192.b12-0 - Add port of 8189170 to AArch64 which is missing from upstream 8u version. - Resolves: rhbz1661577 1:1.8.0.192.b12-0 - Add 8160748 for AArch64 which is missing from upstream 8u version. -...

SQL injection vulnerability in Pr***.asp page of website building system of Taizhou Zhisou Network Technology Co.

Taizhou Zhisou Network Technology Co., Ltd. is engaged in website construction, website production, website revision, website optimization of the network company. Taizhou Zhisou Network Technology Co., Ltd. building system Pr.asp page there is a SQL injection vulnerability, the attacker can use t...

Cross site request forgery (csrf)

Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Request Forgery CSRF vulnerability in API endpoint: /api/ that can result in Task metadata such as task name, id, parameter, etc. will be leake...

pr-lg.ru XSS vulnerability

Open Bug Bounty ID: OBB-710266 Description| Value ---|--- Affected Website:| pr-lg.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

Command Injection

Overview Versions of egg-scripts before 2.8.1 are vulnerable to command injection. This is only exploitable if a malicious argument is provided on the command line. Example: eggctl start --daemon --stderr='/tmp/eggctlstderr.log; touch /tmp/malicious' Recommendation Update to version 2.8.1 or late...

pr-lg.ru XSS vulnerability

Open Bug Bounty ID: OBB-636408 Description| Value ---|--- Affected Website:| pr-lg.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

pr-inside.com XSS vulnerability

Open Bug Bounty ID: OBB-633469 Description| Value ---|--- Affected Website:| pr-inside.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Out-of-bounds Read

Overview Versions of byte before 1.4.1 allocate uninitialized buffers and read data from them past the initialized length Recommendation Update to version 1.4.1 or later. References - HackerOne Report - PR 3 - GitHub Advisory...

Vega Stealer Malware Takes Aim at Chrome, Firefox

A malware dubbed Vega Stealer has been uncovered, looking to make off with saved credentials and credit-card information in the Chrome and Firefox browsers. While it’s a simple payload for now, researchers said it has the ability to evolve into something more concerning in the future. Proofpoint,...

Memory Exposure

Overview Versions of concat-stream before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into write Versions 1.3.0 are not affected due to not using unguarded Buffer constructor. Recommendation Update to version 1.5.2, 1.4.11, 1.3.2 or later. If you are unable to update...

CVE-2018-1000143

CVE-2018-1000143 affects Jenkins GitHub Pull Request Builder Plugin (versions 1.39.0 and earlier) and GhprbCause.java, enabling a local attacker with filesystem access to obtain GitHub credentials. The issue is confirmed across NVD and multiple security trackers. Impact is exposure of credentials...

evento.centralfordpr.com XSS vulnerability

Open Bug Bounty ID: OBB-585445 Description| Value ---|--- Affected Website:| evento.centralfordpr.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Debian DLA-1291-1 : tzdata new upstream version

This update includes the changes in tzdata 2018c. Notable changes are : - So Tom and Prncipe switched from +00 to +01. - Brazil's DST will now start on November's first Sunday. For Debian 7 'Wheezy', these problems have been fixed in version 2018c-0+deb7u1. We recommend that you upgrade your tzda...

pr-lighting.com XSS vulnerability

Open Bug Bounty ID: OBB-555166 Description| Value ---|--- Affected Website:| pr-lighting.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...