Bugzilla 4.2 - Tabular Reports Cross-Site Scripting

Bugzilla 4.2 - Tabular Reports Cross-Site Scripting source: https://www.securityfocus.com/bid/63205/info Bugzilla is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. Attackers can exploit this issue to steal cookie-based authentication...

Bugzilla 4.2 - Tabular Reports Cross-Site Scripting

source: https://www.securityfocus.com/bid/63205/info Bugzilla is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. Attackers can exploit this issue to steal cookie-based authentication information, execute arbitrary client-side scripts in...

Yahoo is now offering up to $15,000 in bug bounty after policy review

Offering cash rewards for vulnerability reports has become something of a norm when it comes to big tech companies these days. Yahoo has changed its bug bounty policies following a deluge of negative feedback in the wake of the news that ethical hackers were rewarded with $12.50 in gift vouchers...

Yahoo is now offering up to $15,000 in bug bounty after policy review

Offering cash rewards for vulnerability reports has become something of a norm when it comes to big tech companies these days. Yahoo has changed its bug bounty policies following a deluge of negative feedback in the wake of the news that ethical hackers were rewarded with $12.50 in gift vouchers...

py-suds -- vulnerable to symlink attacks

SUSE reports: cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/...

Fedora 19 : systemd-204-15.fc19 (2013-17119)

Fixes polkit authentication issue. Updates the hardware database including keyboard mappings to the latest version from upstream. Backport a bunch of fixes from upstream. Only a few correspond to bug reports, and others correct display issues, memory access, and correctness of operation. Note tha...

NASDAQ Patches Reported XSS Vulnerability

A NASDAQ representative confirmed this morning that a cross-site scripting vulnerability on the exchange’s website discovered by an ethical hacker has been patched. The issue was reported on Sept. 2 by Ilia Kolochenko, chief executive of High-Tech Bridge, a Swiss penetration testing company...

CVE-2013-1775

creationtimestamp| type| source ---|---|--- 2013-08-29 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/27944 2013-08-30 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/27965 2018-05-29 15:50:33+00:00| seen|...

CVE-2013-4676

Multiple cross-site scripting XSS vulnerabilities in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a 1 custom-reports generation page, 2 Storage Devices creation page, or 3 jobs creation page...

CVE-2013-4676

Multiple cross-site scripting XSS vulnerabilities in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a 1 custom-reports generation page, 2 Storage Devices creation page, or 3 jobs creation page...

Dell PacketTrap MSP RMM 6.6.x Cross Site Scripting

Title: ====== Dell PacketTrap MSP RMM 6.6.x - Multiple Persistent Web Vulnerabilities Date: ===== 2013-07-17 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=791 VL-ID: ===== 791 Common Vulnerability Scoring System: ==================================== 3.5 Introduction:...

Multiple Vulnerabilities in Cisco Unified Communications Manager

Cisco Unified Communications Manager Unified CM contains multiple vulnerabilities that could be used together to allow an unauthenticated, remote attacker to gather user credentials, escalate privileges, and execute commands to gain full control of the vulnerable system. A successful attack could...

Oracle Linux 5 : Important: / kernel (ELSA-2007-0993)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0993 advisory. - CVE-2007-4571 ALSA memory disclosure flaw - Tick divider bugs on x8664 - CVE-2007-5494 openOATOMICLOOKUP leaks dentry - PATCH jbd: wait for already...

Google, Microsoft Seek Help in Lifting FISA Gag Order

Google and Microsoft have locked arms with a number of civil liberties advocates in filing a brief with the secret Foreign Intelligence Surveillance Court hoping to lift a gag order preventing the two tech giants from releasing information on their role in the NSA’s surveillance activities. To...

Google Asks FISA Court to Allow it to Publish Data on Government Requests

Saying that inaccurate media reports about the PRISM program have damaged the company’s reputation, Google has asked the Foreign Intelligence Surveillance Court for permission to publish the number of requests the company gets for user data under various parts of the Foreign Intelligence...

Cisco Hosted Collaboration Mediation Excessive CPU Utilization Vulnerability

A vulnerability in the network stack of Cisco Hosted Collaboration Mediation could allow an unauthenticated, remote attacker to cause excessive CPU utilization on the affected system. The vulnerability is due to insufficient optimization of resources when the affected system is flooded with...

Cisco Prime Infrastructure Rogue AP SSID Cross-Site Scripting Vulnerability

A vulnerability in the wireless configuration module of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to insert scripts into the listing of rogue access points. The vulnerability is due to a failure to properly sanitize SSIDs before inserting them into the XML windowi...

Cisco Nexus 1000V VSM/VEM Communication Encryption Bypass Vulnerability

Cryptographic issues in the Cisco Nexus 1000v could allow an unauthenticated, remote attacker to to inject traffic or eavesdrop on the communications between a Virtual Supervisor Module VSM and a Virtual Ethernet Module VEM. The issues are due to errors in the implementation of the cryptography...

Cisco Nexus 1000V VSM to vCenter Communication Man-in-the-Middle Vulnerability

A vulnerability in the SSL implementation of the Cisco Nexus 1000V could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against Virtual Supervisor Module VSM to VMware vCenter communications. The vulnerability is due to improper verification of SSL security...

Cisco Nexus 1000V Insufficient VSM/VEM Authentication Vulnerability

A vulnerability in the Cisco Nexus 1000V could allow an unauthenticated, remote attacker to obtain control over a Virtual Ethernet Module VEM and associated port groups. The vulnerability is due to insufficient authentication between a VEM and a Virtual Supervisor Module VSM. An attacker could...