PHP PEAR 'Archive_Tar' Multiple Security Vulnerabilities

Description PEAR ArchiveTar is prone to multiple security vulnerabilities. An attacker can exploit these issues to execute arbitrary code in the context of the application, obtain sensitive information, bypass certain security restrictions and perform unauthorized actions. PEAR ArchiveTar version...

Multiple vulnerabilities in "Custom Body Class"

Overview WordPress Plugin "Custom Body Class" provided by Andrei Lupu contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2019-6029 Cross-site Request Forgery CWE-352 - CVE-2019-6030 Shirai Masatake of Cryptography Laboratory,Department of Information and Communicati...

JVN#26847507: Multiple vulnerabilities in "Custom Body Class"

WordPress Plugin "Custom Body Class" provided by Andrei Lupu contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2019-6029 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2| AV:N/AC:H/Au:N/C:N/I:P/A:N|...

Kinza Cross-Site Scripting Vulnerability

KINZA is a web browser. A cross-site scripting vulnerability exists in KINZA version 5.9.2 and earlier on Windows platforms and version 5.0.0 and earlier on Mac platforms. An attacker can exploit this vulnerability to execute arbitrary script on a user's web browser...

PT-2019-18459 · Synology · Video Station

Name of the Vulnerable Software and Affected Versions: Video Station versions prior to the latest version Description: This issue allows remote attackers to inject and execute scripts on the administrator’s management console through a cross-site scripting XSS vulnerability in Video Station...

PT-2019-15527

Name of the Vulnerable Software and Affected Versions RSA Authentication Manager software versions prior to 8.4 P8 Description The issue concerns a stored cross-site scripting vulnerability in the Security Console of the RSA Authentication Manager software. This vulnerability could be exploited b...

Cross site scripting

A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DO...

CVE-2011-3606

A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DO...

CVE-2019-18982

bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...

CVE-2019-18982

CVE-2019-18982 affects Pimcore prior to version 6.3.0, where the file bundles/AdminBundle/Controller/Admin/EmailController.php in the Email Log preview window can execute scripts due to a missing Content-Security-Policy header. The vulnerability is documented across multiple sources (NVD entry, R...

CVE-2019-18982

bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...

CVE-2019-18982

bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...

CVE-2019-18982: Improper Neutralization of Input During Web Page Generation

bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...

PT-2019-15739

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 6.3.0 Description The issue allows script execution in the Email Log preview window due to the lack of a Content-Security-Policy header in the bundles/AdminBundle/Controller/Admin/EmailController.php file...

PT-2019-14072

Name of the Vulnerable Software and Affected Versions Tecno Camon iClick Android device with a build fingerprint of TECNO/H633/TECNO-IN6:8.1.0/O11019/A-180409V96:user/release-keys Description The issue concerns a pre-installed platform app with a package name of com.lovelyfont.defcontainer that...

PT-2019-6929

Name of the Vulnerable Software and Affected Versions Cryptocat Message Handling version 1.1.165 Description A cross-site scripting XSS issue affects the message handling component. This could potentially allow for malicious script execution. Recommendations For Cryptocat Message Handling version...

Microsoft Office Online CVE-2019-1447 Spoofing Vulnerability

Description Microsoft Office Online is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected Microsoft Office...

Malicious Package

sj-tw-test-security is a malicious package that downloads and runs a script that opens a reverse shell in the system...

Zyxel NBG-418N v2 Modem Cross-Site Request Forgery Vulnerability

The Zyxel NBG-418N is a broadband router. The Zyxel NBG-418N v2 Modem suffers from a cross-site request forgery vulnerability that can be exploited by an attacker to execute arbitrary script code in the context of an affected site to steal cookie-based authentication credentials or perform...

Cross site request forgery (csrf)

An exploitable vulnerability exists in the safe browsing function of the CUJO Smart Firewall, version 7003. The flaw lies in the way the safe browsing function parses HTTP requests. The server hostname is extracted from captured HTTP/HTTPS requests and inserted as part of a Lua statement without...