CVE-2018-8910

Cross-site scripting XSS vulnerability in Attachment Preview in Synology Drive before 1.0.1-10253 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments...

CVE-2018-8910

Cross-site scripting XSS vulnerability in Attachment Preview in Synology Drive before 1.0.1-10253 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments...

CVE-2018-8910

Cross-site scripting XSS vulnerability in Attachment Preview in Synology Drive before 1.0.1-10253 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments...

CVE-2018-8910

Cross-site scripting XSS vulnerability in Attachment Preview in Synology Drive before 1.0.1-10253 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments...

CVE-2018-8910

CVE-2018-8910 is a cross-site scripting (XSS) vulnerability in Synology Drive’s Attachment Preview prior to 1.0.1-10253. An authenticated remote user can inject arbitrary web script or HTML via a malicious attachment. The publicly documented details indicate network access with low attack complex...

PT-2018-18709 · Synology · Synology Drive

Name of the Vulnerable Software and Affected Versions: Synology Drive versions prior to 1.0.1-10253 Description: The issue is related to a cross-site scripting XSS vulnerability in the Attachment Preview feature. This allows remote authenticated users to inject arbitrary web script or HTML via...

CVE-2018-8911

Cross-site scripting XSS vulnerability in Attachment Preview in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments...

CVE-2018-8911

Cross-site scripting XSS vulnerability in Attachment Preview in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments...

Cross site scripting

Cross-site scripting XSS vulnerability in Attachment Preview in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments...

Microsoft Adds Support for JavaScript in Excel—What Could Possibly Go Wrong?

Shortly after Microsoft announced support for custom JavaScript functions in Excel, someone demonstrated what could possibly go wrong if this feature is abused for malicious purposes. As promised last year at Microsoft's Ignite 2017 conference, the company has now brought custom JavaScript...

CVE-2018-8911

Cross-site scripting XSS vulnerability in Attachment Preview in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments...

Moderate: Red Hat Security Advisory: go-toolset-7 and go-toolset-7-golang security and bug fix update

An update for go-toolset-7 and go-toolset-7-golang is now available for Red Hat Developer Tools. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

March 22, 2018—KB4088883 (Preview of Monthly Rollup)

None None...

Apple Siri is the aeration privacy vulnerability: lock screen notifications directly read-vulnerability warning-the black bar safety net

! iOS 11, Apple introduced a new way to protect user privacy, the user through the iPhone's lock screen hide notification content, until the use of Touch ID or Face ID to unlock the device. But in fact, even if unable to unlock the phone, or is there a very simple way to read these hidden...

Eramba Cross-Site Scripting Vulnerability (CNVD-2018-06086)

Eramba is an open source, enterprise-level IT governance application from Eramba UK. The program features IT security, compliance auditing and analysis, and more. A cross-site scripting vulnerability exists in the error page of the CSV file inclusion tab of /importTool/preview URI in Eramba e...

CVE-2018-7997

Eramba e1.0.6.033 has Reflected XSS on the Error page of the CSV file inclusion tab of the /importTool/preview URI, with a CSV file polluted with malicious JavaScript...

Cross site scripting

Eramba e1.0.6.033 has Reflected XSS on the Error page of the CSV file inclusion tab of the /importTool/preview URI, with a CSV file polluted with malicious JavaScript...

Shopify: Access to Private Photos of Apps in App section(IDOR)

Bug location : https://MyShop.myshopify.com/admin/apps Description : Previewing the Photo In App section Request is vulnerable to IDOR attack where changing the ID leads to Disclose Link of Private photos. Also It discloses the Shop Domain details also. The request goes through...

foreman: Information disclosure in provisioning template previews

A flaw was found in foreman's handling of template previews. An attacker with permissions to preview host templates can access the template preview for any host if they are able to guess the host name, disclosing potentially sensitive information...

February 2018 Preview of the Quality Rollups for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 for Windows 8.1, RT 8.1 and Server 2012 R2 (KB 4074807)

February 2018 Preview of the Quality Rollups for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 for Windows 8.1, RT 8.1 and Server 2012 R2 KB 4074807 Notice Update KB 4074807 has been released as part of the Preview of Quality Rollups for .NET Framework for February 2018. Parts ...