CVE-2018-14037: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor because of the editorNS.Serializer toEditableHtml function in kendo.all.min.js. If the victim accesses the editor, the payload...

CVE-2018-17056: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ServiceStack in Progress Sitefinity CMS versions 10.2 through 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-17055: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads...

Progress Kendo UI Editor 2018.1.221 Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Stored Cross-Site Scripting product: Progress Kendo UI Editor vulnerable version: v2018.1.221 fixed version: none, see workaround CVE number: CVE-2018-14037 impact: mediu...

Unable to launch the published application.

Unable to launch the published application. The progress window shows the Welcome screen, applying group policies, Citrix Profile management etc and then disappears. No time out or failing errors on the VDA found...

Progress Telerik JustAssembly and JustDecompile Code Execution Vulnerabilities

Progress Telerik JustAssembly and JustDecompile are both products of Progress Software, Inc. Progress Telerik JustAssembly is a code diff checking and decompilation tool.JustDecompile is an open source Decompile is an open source decompilation engine. A security vulnerability exists in Progress...

CVE-2018-15122

An issue found in Progress Telerik JustAssembly through 2018.1.323.2 and JustDecompile through 2018.2.605.0 makes it possible to execute code by decompiling a compiled .NET object such as DLL or EXE with an embedded resource file by clicking on the resource...

Design/Logic Flaw

An issue found in Progress Telerik JustAssembly through 2018.1.323.2 and JustDecompile through 2018.2.605.0 makes it possible to execute code by decompiling a compiled .NET object such as DLL or EXE with an embedded resource file by clicking on the resource...

CVE-2018-15122

Progress Telerik JustAssembly (up to 2018.1.323.2) and JustDecompile (up to 2018.2.605.0) contain a vulnerability that enables code execution by decompiling a compiled .NET object (DLL/EXE) with an embedded resource file when the resource is clicked. The issue is documented across multiple source...

CVE-2018-15122

An issue found in Progress Telerik JustAssembly through 2018.1.323.2 and JustDecompile through 2018.2.605.0 makes it possible to execute code by decompiling a compiled .NET object such as DLL or EXE with an embedded resource file by clicking on the resource...

CVE-2018-15122: Improper Input Validation

An issue found in Progress Telerik JustAssembly through 2018.1.323.2 and JustDecompile through 2018.2.605.0 makes it possible to execute code by decompiling a compiled .NET object such as DLL or EXE with an embedded resource file by clicking on the resource...

PT-2018-12882

Name of the Vulnerable Software and Affected Versions Progress Telerik JustAssembly versions through 2018.1.323.2 Progress Telerik JustDecompile versions through 2018.2.605.0 Description An issue in Progress Telerik JustAssembly and JustDecompile makes it possible to execute code by decompiling a...

Security Bulletin: Multiple vulnerabilities affect IBM InfoSphere Information Server (CVE-2015-0383, CVE-2015-0410, CVE-2014-6593 CVE-2015-0138 CVE-2015-2808)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6 and 7 that are used by IBM InfoSphere Information Server. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses the “FREAK: Factoring Attack on...

progress-film.de XSS vulnerability

Open Bug Bounty ID: OBB-631846 Description| Value ---|--- Affected Website:| progress-film.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Who’s who in the Zoo

ZooPark is a cyberespionage operation that has been focusing on Middle Eastern targets since at least June 2015. The threat actors behind the operation infect Android devices using several generations of malware, with the attackers including new features in each iteration. We label them from v1-v...

Security update for lame (important)

This update for lame fixes the following issues: Lame was updated to version 3.100: Improved detection of MPEG audio data in RIFF WAVE files. sf3545112 Invalid sampling detection New switch --gain decibel, range -20.0 to +12.0, a more convenient way to apply Gain adjustment in decibels, than the...

Progress Sitefinity Information Disclosure Vulnerability

Progress Sitefinity is an open source platform for building corporate websites and intranets. A security vulnerability exists in Progress Sitefinity version 9.1, which stems from the fact that the wrapaccesstoken remains valid and is passed via a GET parameter after a session termination or...

CVE-2017-18091

The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the filename of a backu...

Progress Sitefinity Open Redirect Vulnerability

Progress Sitefinity is an open source platform for building corporate websites and intranets. An open redirect vulnerability exists in Authenticate/SWT in Progress Sitefinity version 9.1. An attacker can exploit this vulnerability to redirect users to arbitrary websites...

Progress Sitefinity Cross-Site Scripting Vulnerability (CNVD-2018-05684)

Progress Sitefinity is an open source platform for building corporate websites and intranets. A cross-site scripting vulnerability exists in Progress Sitefinity version 9.1. The vulnerability can be exploited by remote attackers to inject malicious JavaScript code via the Last name, First name, a...