Nested Pages <= 3.0.7 - Post Edit Bypass

Contributors could quick edit posts not authored by themselves, and could allow them to change the slugs as well as titles...

Gitlab -- Vulnerability

Gitlab reports: Project Runner Token Exposed Through Issues Quick Actions...

GitLab: JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions

The Quick Actions interpreter allows an attacker to reference a Project it does not have access to. The model attributes are then being serialized and returned to the user, which results in the Runner token both encrypted and unencrypted being returned to the user. This vulnerability is currently...

Simplifying Security Configuration: A UX Revamp Retrospective

With the March 2019 Release update, the Security Configuration User Interface UI evolution is now complete, and we hope it integrates more seamlessly into your online business. Over time, Akamai has added new products, features, and functionality to its security solutions to protect your web...

BeEF - The Browser Exploitation Framework Project

What is BeEF? BeEF is short for The BrowserExploitation Framework. It is a penetration testing tool that focuses on the web browser. Amid growing concerns about web-borne attacks against clients, including mobile clients, BeEF allows the professional penetration tester to assess the actual securi...

Ian Dunn: XSSI: Quick Navigation Interface - leak of private page/post titles

CVSS ---- Medium 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Description ----------- The Quick Navigation Interface plugin includes the names of all posts and pages in an automatically generated JavaScript file. By including this file in their own page, an attacker can view all post titles -...

Cross-Site Scripting (XSS)

modx/revolution is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via a document resource such as pagetitle through the update or quick edit action. The Javascript is executed when viewing manager logs...

Cross site scripting

MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...

CVE-2018-20756

MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...

CVE-2018-20756

MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...

CVE-2018-20756

MODX Revolution (through v2.7.0-pl) is affected by a cross-site scripting (XSS) vulnerability via a document resource (e.g., pagetitle) that is mishandled during Update or Quick Edit actions, or when viewing manager logs. The issue is documented across multiple sources (NVD and related advisories...

Jok3R - Network And Web Pentest Framework

Jok3r is a Python3 CLI application which is aimed at helping penetration testers for network infrastructure and web black-box security tests. Its main goal is to save time on everything that can be automated during network/web pentest in order to enjoy more time on more interesting and challengin...

Qualys Cloud Platform (VM, PC) 8.16 New Features

This new release of the Qualys Cloud Platform VM, PC, version 8.16, contains several new improvements in Qualys Vulnerability Management and Qualys Policy Compliance, which includes new password security option, increased limit for virtual hosts that can be added to a subscription, added support...

EMC RSA Authentication Manager < 8.4 Relative Path Traversal (DSA-2018-226)

The version of EMC RSA Authentication Manager running on the remote host is prior to 8.4. It is, therefore, affected by a relative path traversal vulnerability in the Quick Setup component. An attacker could provide an administrator with a maliciously crafted license file to be used during the...

CVE-2018-15782

The Quick Setup component of RSA Authentication Manager versions prior to 8.4 is vulnerable to a relative path traversal vulnerability. A local attacker could potentially provide an administrator with a crafted license that if used during the quick setup deployment of the initial RSA Authenticati...

Path traversal

The Quick Setup component of RSA Authentication Manager versions prior to 8.4 is vulnerable to a relative path traversal vulnerability. A local attacker could potentially provide an administrator with a crafted license that if used during the quick setup deployment of the initial RSA Authenticati...

CVE-2018-15782

The Quick Setup component of RSA Authentication Manager versions prior to 8.4 is vulnerable to a relative path traversal vulnerability. A local attacker could potentially provide an administrator with a crafted license that if used during the quick setup deployment of the initial RSA Authenticati...

CVE-2018-15782 DSA-2018-226: RSA® Authentication Manager Relative Path Traversal Vulnerability

The Quick Setup component of RSA Authentication Manager versions prior to 8.4 is vulnerable to a relative path traversal vulnerability. A local attacker could potentially provide an administrator with a crafted license that if used during the quick setup deployment of the initial RSA Authenticati...

CVE-2018-15782

The CVE-2018-15782 entry affects EMC RSA Authentication Manager prior to version 8.4, where the Quick Setup component is vulnerable to a relative path traversal. A local attacker could use a crafted license during initial quick setup to obtain unauthorized access to the system. Data from the init...

Denial Of Service (DoS)

qemu-kvm-rhev is vulnerable to denial of service DoS attacks. The vulnerability exists as the addressspacewritecontinue function in exec.c in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service out-of-bounds access and guest instance crash by leveraging use...