Cross site scripting

OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list payload in the common name that is mishandled in the scheduling view...

CVE-2021-31935

OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list payload in the common name that is mishandled in the scheduling view...

CVE-2021-31935

OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list payload in the common name that is mishandled in the scheduling view...

CVE-2021-31935

OX App Suite 7.10.4 and earlier is vulnerable to Cross-Site Scripting via a crafted distribution list, where the payload in the distribution list’s common name is mishandled in the scheduling view. This vulnerability is described consistently across CVE-2021-31935 records (NVD, Red Hat, CNVD, CVE...

PT-2021-19608

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.4 and earlier Description: The issue allows for cross-site scripting XSS attacks via a crafted distribution list. Specifically, a payload in the common name of the distribution list is mishandled when viewed in the...

CVE-2021-31935: Improper Neutralization of Input During Web Page Generation

OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list payload in the common name that is mishandled in the scheduling view...

Open-xchange OX App Suite 跨站脚本漏洞

Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite 7.10.4 and prior...

Denial Of Service (DoS)

activemq-broker is vulnerable to denial of service Dos. The library does not properly implement bounds checking on the message scheduling properties, allowing a malicious user to cause an application crash by sending many messages with a repeat value of Integer...

Code injection

Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read permission to schedule builds of projects without having Item/Build permission...

CVE-2021-21647

Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read permission to schedule builds of projects without having Item/Build permission...

CVE-2021-21647

Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read permission to schedule builds of projects without having Item/Build permission...

PT-2021-14690 · Cloudbees +1 · Jenkins Cloudbees Cd Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins CloudBees CD Plugin versions 1.1.21 and earlier Description: The issue concerns a lack of permission check in an HTTP endpoint, allowing attackers with Item/Read permission to schedule builds of projects without having Item/Build...

SUSE: Security Advisory (SUSE-SU-2020:3424-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Back in a Bit: Attacker Use of the Windows Background Intelligent Transfer Service

In this blog post we will describe: How attackers use the Background Intelligent Transfer Service BITS Forensic techniques for detecting attacker activity with data format specifications Public release of the BitsParser tool A real-world example of malware using BITS persistence --- Introduction...

The vulnerability in the scheduling component of the Google Chrome browser allows a perpetrator to access confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of Google Chrome’s browser scheduling component relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service interruptions...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Huawei eUDC660 Improper Resource Management Vulnerability

The Huawei eUDC660 is a device from Huawei, China, that provides scheduling capabilities. The device supports broadband trunk scheduling to improve the efficiency of voice, data, and video communications in transportation, energy, and other areas. A security vulnerability exists in Huawei eUDC660...

Kubernetes: Node Validation Admission does not observe all oldObject fields

Summary: The Validating Admission webhook for Node Objects is passing oldObject fields incorrectly on AdmissionReview.Request. It was identified initially in metadata.labels, but a list of impacted fields follows below: oldNode.Spec.PodCIDRs oldNode.Spec.ProviderID oldNode.Spec.ConfigSource...

[SECURITY] [DSA 4841-1] slurm-llnl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4841-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 27, 2021 https://www.debian.org/security/faq -...

XXL-JOB cross-site scripting vulnerability (CNVD-2021-44699)

XXL-JOB is a distributed task scheduling platform whose core design goals are rapid development, simple learning, lightweight and easy to extend. A stored cross-site scripting vulnerability exists in XXL-JOB 2.2.0 in the "Add User" section, which can be exploited to bypass a 20-minute vulnerabili...