PT-2019-18459 · Synology · Video Station

Name of the Vulnerable Software and Affected Versions: Video Station versions prior to the latest version Description: This issue allows remote attackers to inject and execute scripts on the administrator’s management console through a cross-site scripting XSS vulnerability in Video Station...

PT-2019-15527

Name of the Vulnerable Software and Affected Versions RSA Authentication Manager software versions prior to 8.4 P8 Description The issue concerns a stored cross-site scripting vulnerability in the Security Console of the RSA Authentication Manager software. This vulnerability could be exploited b...

Cross site scripting

A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DO...

CVE-2011-3606

A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DO...

CVE-2019-18982

bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...

CVE-2019-18982

bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...

CVE-2019-18982

CVE-2019-18982 affects Pimcore prior to version 6.3.0, where the file bundles/AdminBundle/Controller/Admin/EmailController.php in the Email Log preview window can execute scripts due to a missing Content-Security-Policy header. The vulnerability is documented across multiple sources (NVD entry, R...

CVE-2019-18982

bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...

PT-2019-15739

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 6.3.0 Description The issue allows script execution in the Email Log preview window due to the lack of a Content-Security-Policy header in the bundles/AdminBundle/Controller/Admin/EmailController.php file...

CVE-2019-18982: Improper Neutralization of Input During Web Page Generation

bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...

PT-2019-6929

Name of the Vulnerable Software and Affected Versions Cryptocat Message Handling version 1.1.165 Description A cross-site scripting XSS issue affects the message handling component. This could potentially allow for malicious script execution. Recommendations For Cryptocat Message Handling version...

PT-2019-14072

Name of the Vulnerable Software and Affected Versions Tecno Camon iClick Android device with a build fingerprint of TECNO/H633/TECNO-IN6:8.1.0/O11019/A-180409V96:user/release-keys Description The issue concerns a pre-installed platform app with a package name of com.lovelyfont.defcontainer that...

Microsoft Office Online CVE-2019-1447 Spoofing Vulnerability

Description Microsoft Office Online is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected Microsoft Office...

Malicious Package

sj-tw-test-security is a malicious package that downloads and runs a script that opens a reverse shell in the system...

Zyxel NBG-418N v2 Modem Cross-Site Request Forgery Vulnerability

The Zyxel NBG-418N is a broadband router. The Zyxel NBG-418N v2 Modem suffers from a cross-site request forgery vulnerability that can be exploited by an attacker to execute arbitrary script code in the context of an affected site to steal cookie-based authentication credentials or perform...

Cross site request forgery (csrf)

An exploitable vulnerability exists in the safe browsing function of the CUJO Smart Firewall, version 7003. The flaw lies in the way the safe browsing function parses HTTP requests. The server hostname is extracted from captured HTTP/HTTPS requests and inserted as part of a Lua statement without...

CVE-2018-4031

An exploitable vulnerability exists in the safe browsing function of the CUJO Smart Firewall, version 7003. The flaw lies in the way the safe browsing function parses HTTP requests. The server hostname is extracted from captured HTTP/HTTPS requests and inserted as part of a Lua statement without...

CVE-2018-4031

CVE-2018-4031 affects CUJO Smart Firewall firmware 7003. The safe-browsing component abuses Lunatik (kernel Lua) by injecting unsanitized Host header data into a Lua statement, enabling arbitrary code execution in the kernel. Exploitation can occur via crafted HTTP/HTTPS requests containing a mal...

PT-2019-10764

Name of the Vulnerable Software and Affected Versions CUJO Smart Firewall version 7003 Description The issue exists in the safe browsing function, where the parsing of HTTP requests is flawed. Specifically, the server hostname extracted from captured HTTP/HTTPS requests is inserted into a Lua...

CVE-2018-4031: Improper Control of Generation of Code

An exploitable vulnerability exists in the safe browsing function of the CUJO Smart Firewall, version 7003. The flaw lies in the way the safe browsing function parses HTTP requests. The server hostname is extracted from captured HTTP/HTTPS requests and inserted as part of a Lua statement without...