CVE-2016-7840

CVE-2016-7840 is a Cross-site Scripting (XSS) vulnerability in WEB SCHEDULE (Olive Design). The issue arises from a flaw in processing the month parameter, allowing remote actors to inject arbitrary web script or HTML. Documented references (JVN entries) describe CWE-79 and indicate impact on the...

CVE-2016-7840

Cross-site scripting vulnerability in WEB SCHEDULE allows remote attackers to inject arbitrary web script or HTML via the month parameter...

FIN7 Evolution and the Phishing LNK

FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015. FIN7 is referred to by many vendors as “Carbanak Group”, although we do not equate all usage of the CARBANAK backdoor with FIN7. FireEye recently observed a FIN7 spear phishin...

CVE-2016-4870

Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the Schedule function...

Cross site scripting

Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the Schedule function...

CVE-2016-4870

Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the Schedule function...

CVE-2016-4870

Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the Schedule function...

CVE-2016-4870

CVE-2016-4870 is a cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0, exploitable via the Schedule function by a remote, authenticated attacker who can inject script or HTML into the victim’s browser. Affected product: Cybozu Office versions 9.0.0–10.4.0. Root cause: improper ha...

CVE-2016-6100

IBM Disposal and Governance Management for IT and IBM Global Retention Policy and Schedule Management, components of IBM Atlas Policy Suite 6.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that th...

Trend Micro InterScan Web Security Virtual Appliance config_date_time Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro InterScan Web Security Virtual Appliance. Authentication is required to exploit this vulnerability. The specific flaw exists within configdatetime.jsp's setNTPSchedule method. A crafted...

Using Task Scheduler to automate the collection of CDF traces

It gets difficult at times when we need to capture CDF traces for a specific period of time. We have different tools like CDF Control, Scout and CDF Monitor, however it requires manual intervention to start and stop the traces and yet there are chances that the traces might get over-written if yo...

Schedule SMS MMS EMAIL - Base64 encoded String, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Schedule SMS MMS EMAIL published at the 'play' market has multiple vulnerabilities...

Microsoft Waits for Patch Tuesday to Fix SMB Zero Day

Microsoft will not rush out an emergency patch for a zero-day vulnerability disclosed on Wednesday in the Windows implementation of the Server Message Block protocol. Researcher Laurent Gaffie announced in a tweet, below, that he’d found a zero-day vulnerability in SMBv3 and released a...

WEB SCHEDULE vulnerable to cross-site scripting

Overview WEB SCHEDULE provided by Olive Design contains a cross-site scripting vulnerability CWE-79 due to a flaw in processing the month parameter. Impact An artbitrary script may be executed on the user's web browser. Solution Do not use WEB SCHEDULE WEB SCHEDULE is no longer being developed or...

OracleVM 3.2 : Unbreakable / etc (OVMSA-2016-0181)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/iopl/64: properly context-switch IOPL on Xen PV Andy Lutomirski Orabug: 25269184 CVE-2016-3157 - net: Fix use after free in the recvmmsg exit path Arnaldo Carvalho de Melo Orabug: 25298618...

Oracle PeopleSoft Enterprise HCM Component Remote Data Read Vulnerability

Oracle PeopleSoft is a suite of enterprise human capital management solutions from Oracle that provides human capital management, financial management, supplier relationship management, etc. PeopleSoft Enterprise HCM is one of the human capital management HCM components. A remote data read...

"Schedule" function in Cybozu Office vulnerable to cross-site scripting

Overview Cybozu Office provided by Cybozu,Inc. contains a cross-site scripting vulnerability. Kusano Kazuhiko reported this vulnerability to Cybozu, Inc., and Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated...

WordPress Appointment Schedule Booking System - Authenticated Stored XSS

The wp-appointment-schedule-booking-system WordPress plugin was affected by an Authenticated Stored XSS security vulnerability...

WordPress Appointment Schedule Booking System Plugin - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress Appointment Schedule Booking System Plugin - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...