6001 matches found
September 2018 Preview of the Quality Rollups for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, and 4.7.2 for Windows 7 SP1 and Windows Server 2008 R2 SP1 (KB 4458611)
September 2018 Preview of the Quality Rollups for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, and 4.7.2 for Windows 7 SP1 and Windows Server 2008 R2 SP1 KB 4458611 Notice This update is included in the Security and Quality Rollup that's dated October 9, 2018. This update was...
PT-2019-9474
Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 5.0.2 Description The issue concerns open redirects. Specifically, it affects the FORWARD URL parameter in the html/common/forward js.jsp endpoint and the hostname parameter in the html/portlet/ext/common/page preview...
October 2018 Preview of the Quality Rollups for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, and 4.7.2 for Windows 7 SP1 and Server 2008 R2 SP1 (KB 4462500)
October 2018 Preview of the Quality Rollups for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, and 4.7.2 for Windows 7 SP1 and Server 2008 R2 SP1 KB 4462500 Applies to: Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET...
CVE-2018-18496: Improper Restriction of Rendered UI Layers or Frames
When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. Note: This issue only affects Windows operating...
CVE-2018-20791
tecrail Responsive FileManager 9.13.4 allows XSS via a media file upload with an XSS payload in the name, because of mishandling of the mediapreview action...
PT-2019-10233
Name of the Vulnerable Software and Affected Versions: tecrail Responsive FileManager version 9.13.4 Description: The issue arises from the mishandling of the media preview action, allowing for a cross-site scripting XSS attack when a media file is uploaded with an XSS payload in its name...
WordPress: Stored XSS in Post Preview as Contributor
Root cause I noticed that the getthecontent makes a pregreplacecallback after all other validation and sanitization has been performed. function getthecontent $morelinktext = null, $stripteaser = false global $page, $more, $preview, $pages, $multipage; $post = getpost; ... if $preview // Preview...
Preview of Quality Rollup updates for .NET Framework 2.0 SP2, 3.0 SP2, 4.5.2, and 4.6 for Windows Server 2008 SP2 (KB4487259)
Preview of Quality Rollup updates for .NET Framework 2.0 SP2, 3.0 SP2, 4.5.2, and 4.6 for Windows Server 2008 SP2 KB4487259 Applies to: Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.0 Service Pack 2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6 This updat...
Preview of Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 7 SP1 and Server 2008 R2 SP1 (KB4487256)
Preview of Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 7 SP1 and Server 2008 R2 SP1 KB4487256 Applies to: Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6.1, Microsoft .N...
Up (Ultimate Plumber) - Tool For Writing Linux Pipes With Instant Live Preview
up is the Ultimate Plumber , a tool for writing Linux pipes in a terminal-based UI interactively, with instant live preview of command results. The main goal of the Ultimate Plumber is to help interactively and incrementally explore textual data in Linux, by making it easier to quickly build...
Security Bulletin: IBM OpenPages GRC Platform is affected by CKEditor (Preview Plugin) vulnerability (CVE-2014-5191)
Summary IBM OpenPages GRC Platform has addressed CKEditor Preview Plugin vulnerability CVE-2014-5191 Vulnerability Details CVEID: CVE-2014-5191 DESCRIPTION: Preview Plugin for CKEditor is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker...
CVE-2019-7250
An issue was discovered in the Cross Reference Add-on 36 for Google Docs. Stored XSS in the preview boxes in the configuration panel may allow a malicious user to use both label text and references text to inject arbitrary JavaScript code via SCRIPT elements, event handlers, etc.. Since this code...
PT-2019-18480
Name of the Vulnerable Software and Affected Versions Cross Reference Add-on version 36 for Google Docs Description An issue in the Cross Reference Add-on allows stored XSS in the preview boxes of the configuration panel. A malicious user can inject arbitrary JavaScript code using SCRIPT elements...
Rundeck Community Edition Cross Site Scripting
Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prin...
Rundeck Community Edition < 3.0.13 - Persistent Cross-Site Scripting Vulnerability
Exploit for java platform in category web applications Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact:...
DRUPAL-CONTRIB-2019-004
The Preview Link module enables you to generate preview links so anonymous users can access unpublished revisions of content. The last release of the module introduced an access bypass allowing users to present invalid tokens but still access unpublished content...
PT-2019-20513
The Preview Link module enables you to generate preview links so anonymous users can access unpublished revisions of content. The last release of the module introduced an access bypass allowing users to present invalid tokens but still access unpublished content...
Preview Link - Moderately critical - Access bypass - SA-CONTRIB-2019-004
The Preview Link module enables you to generate preview links so anonymous users can access unpublished revisions of content. The last release of the module introduced an access bypass allowing users to present invalid tokens but still access unpublished content...
January 17, 2019âKB4480974 (Preview of Monthly Rollup)
None None...
CVE-2018-5738 Some versions of BIND can improperly permit recursive query service to unauthorized clients
Change 4777 introduced in October 2017 introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended and documented behavior is that if an operator has not specified a value for the...