CVE-2017-12980

DokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed, in /inc/parser/xhtml.php. An attacker can create or edit a wiki that uses RSS or Atom data from an attacker-controlled server to trigger JavaScript execution. The JavaScript can be in an author field, as...

CVE-2017-12980

DokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed, in /inc/parser/xhtml.php. An attacker can create or edit a wiki that uses RSS or Atom data from an attacker-controlled server to trigger JavaScript execution. The JavaScript can be in an author field, as...

CVE-2017-12980

DokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed, in /inc/parser/xhtml.php. An attacker can create or edit a wiki that uses RSS or Atom data from an attacker-controlled server to trigger JavaScript execution. The JavaScript can be in an author field, as...

CVE-2017-12980

CVE-2017-12980 : DokuWiki versions up to 2017-02-19c are vulnerable to stored XSS via RSS/Atom feeds rendered in /inc/parser/xhtml.php. An attacker can inject JavaScript (e.g., in the dc:creator element) by supplying attacker-controlled data from a feed, leading to script execution in a user’s br...

CVE-2017-12980

DokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed, in /inc/parser/xhtml.php. An attacker can create or edit a wiki that uses RSS or Atom data from an attacker-controlled server to trigger JavaScript execution. The JavaScript can be in an author field, as...

Debian DSA-3947-1 : newsbeuter - security update

Jeriko One discovered that newsbeuter, a text-mode RSS feed reader, did not properly escape the title and description of a news article when bookmarking it. This allowed a remote attacker to run an arbitrary shell command on the client machine. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Debian DLA-1061-1 : newsbeuter security update

Jeriko One discovered that newsbeuter, a text-mode RSS feed reader, did not properly escape the title and description of a news article when bookmarking it. This allowed a remote attacker to run an arbitrary shell command on the client machine. For Debian 7 'Wheezy', these problems have been fixe...

CVE-2017-12980: Improper Neutralization of Input During Web Page Generation

DokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed, in /inc/parser/xhtml.php. An attacker can create or edit a wiki that uses RSS or Atom data from an attacker-controlled server to trigger JavaScript execution. The JavaScript can be in an author field, as...

PT-2017-12819

Name of the Vulnerable Software and Affected Versions DokuWiki versions prior to 2017-02-19c Description The issue allows for stored XSS when rendering malicious RSS or Atom feeds, specifically in the /inc/parser/xhtml.php file. An attacker can exploit this by creating or editing a wiki that uses...

[ASA-201708-15] newsbeuter: arbitrary code execution

Arch Linux Security Advisory ASA-201708-15 ========================================== Severity: High Date : 2017-08-20 CVE-ID : CVE-2017-12904 Package : newsbeuter Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-384 Summary ======= The package newsbeuter...

[SECURITY] [DSA 3947-1] newsbeuter security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3947-1 [email protected] https://www.debian.org/security/ Sebastien Delafond August 18, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3947-1] newsbeuter security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3947-1 [email protected] https://www.debian.org/security/ Sebastien Delafond August 18, 2017 https://www.debian.org/security/faq -...

PT-2017-2775

Name of the Vulnerable Software and Affected Versions Newsbeuter versions 0.7 through 2.9 Description The issue is related to improper neutralization of special elements used in an OS command in the bookmarking function. This allows remote attackers to perform user-assisted code execution by...

Debian: Security Advisory (DSA-3947-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UPDATE: WordPress Exploit Framework v1.6.1!

PenTestIT RSS Feed Wow I seem to have missed a lot of updates lately. This time, I missed an update about WPXF. We now have the WordPress Exploit Framework v1.6.1 amongst us! This new version among other things updates a major bug that occurred while updating the framework and adds multiple new...

Metasploit Wrapup

With Hacker Summer Camp 2017 wrapped up and folks now recovering from it, why not grab a drink and read up on what's new with Metasploit? Where there's smoke... At least a few versions of open source firewall IPFire contain a post-auth RCE vulnerability, and we well, you! now have a module to hel...

UPDATE: OSRFramework 0.17.0 BlackHat Arsenal Version!

PenTestIT RSS Feed Sometime early last month, I made a post about OSRFramework which was version 0.16.8. A new version of this open sources research framework was released at the recently concluded BlackHat 2017 conference. To be precise, it was released on Wednesday, July 26 in the OSINT Arsenal...

Tiny Tiny RSS Cross-Site Scripting Vulnerability

Tiny Tiny RSS is an open source use of PHP language written RSS RSS Simple Syndication reader . A cross-site scripting vulnerability exists in previous versions of Tiny Tiny RSS 829d478f. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

UPDATE: Luckystrike 2.0!

PenTestIT RSS Feed My first post regarding this malicious Microsoft Office document generator was about an older version. However a few hours ago, an update was released - Luckystrike 2.0! Major highlights for this awesome release include full support for Microsoft Word in addition to a new COM...

Information Leakage

Moodle is vulnerable to information leakage. When RSS tokens are used to impersonate another user, rss/file.php shows a rss feed error shows block information of the impersonated user...