Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CNVD-2019-21297)

Cisco Firepower Management Center FMC is a new generation of firewall management center software from Cisco. A cross-site scripting vulnerability exists in the RSS dashboard of the web-based management interface in Cisco FMC, which stems from the web-based management interface failing to adequate...

Design/Logic Flaw

A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines...

CVE-2017-15123

CVE-2017-15123 affects Red Hat CloudForms web interface versions 5.8–5.10, where RSS feed URLs are not properly access-restricted to authenticated users, enabling disclosure of potentially sensitive data (e.g., newly created virtual machines). The entry is supported by NVD (CVSS v2 base 5.0, CVSS...

CVE-2017-15123

A flaw was found in the CloudForms web interface where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines...

Slack Bug Allows Remote File Hijacking, Malware Injection

A remotely exploitable vulnerability in the Windows desktop app version of the Slack collaboration platform has been uncovered, which allows attackers to alter where files from Slack are downloaded. Nefarious types could redirect the files to their own SMB server; and, they could manipulate the...

Cross Site Scripting (XSS)

Mozilla Thunderbird is vulnerable to cross site scripting XSS vulnerability. This affects an unknown functionality of the component RSS Feed Handler. Attackers can execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website...

Code Injection

Mozilla Thunderbird is vulnerable to remote code execution vulnerability. RSS fields can inject new lines into the created email structure, modifying the message body...

Information Disclosure

Mozilla Thunderbird is vulnerable to information disclosure. Attackers can use a crafted CSS in an RSS feed that would leak and reveal local path strings, which may contain user name...

Cross site scripting

Multiple stored cross-site scripting XSS in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via fields as follows: 1 Title, 2 Favicon, 3 Meta Description, 4 Subscribe Form Name field label, Last name field label, Email...

Cross Site Scripting in extension "gkh RSS Import" (gkh_rss_import)

The extension fails to properly encode user input for output in HTML context...

Researcher Hijacks a Microsoft Service Using Loophole in Azure Cloud Platform

A cybersecurity professional today demonstrated a long-known unpatched weakness in Microsoft's Azure cloud service by exploiting it to take control over Windows Live Tiles, one of the key features Microsoft built into Windows 8 operating system. Introduced in Windows 8, the Live tiles feature was...

Moodle CMS 3.5.x <= 3.5.3 SSRF vulnerability.

Moodle CMS is prone to an SSRF attack. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either...

Server-Side Request Forgery (SSRF)

moodle/moodle is vulnerable to server-side request forgery SSRF. An attacker is able to submit requests on behalf of the server via the editblog.php script that allows adding of external RSS feed resources. A malicious URL/TCP PORT can be added as an RSS feed resource which would cause the server...

Mail.ru: XXE on pulse.mail.ru

XML External Entity injection XXE in RSS/Atom feed parsing code in pulse.mail.ru allowed access to local files. All Mail.Ru projects are covered by extended scope bug bounty program...

CVE-2018-18496

When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. Note: This issue only affects Windows operating...

CVE-2018-18496

When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. Note: This issue only affects Windows operating...

CVE-2018-18496

When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. Note: This issue only affects Windows operating...

Code injection

When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. Note: This issue only affects Windows operating...

CVE-2018-18496

When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. Note: This issue only affects Windows operating...

CVE-2018-18496

CVE-2018-18496 is a clickjacking vulnerability in Mozilla Firefox’s feed preview page about:feeds. When the RSS Feed preview is framed in another page, scripted content can coerce a user into downloading and executing an executable from a temporary directory. It affects Firefox versions earlier t...