1621 matches found
WordPress Calculated Fields Form plugin <= 1.0.353 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability found by Ben Armstrong Spider Sec Ltd in WordPress Calculated Fields Form plugin versions = 1.0.353. Solution Update the WordPress Calculated Fields Form plugin to the latest available version at least 1.0.354...
The Case for Cyber-Risk Prospectuses
Sometimes our investments lose money. It’s not for lack of trying, indeed most investment firms make money off the growth of our investments. But despite best intentions and detailed investment plans, we sometimes end up with less than that with which we started. This can be due to outside forces...
SALTO ProAccess SPACE 5.5 Traversal / File Write / XSS / Bypass
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Critical Vulnerabilities product: SALTO ProAccess SPACE vulnerable version: = v5.6 CVE number: CVE-2019-19457, CVE-2019-19458, CVE-2019-19459, CVE-2019-19460...
CVE-2019-3422
The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related product team, the information disclosure vulnerability is confirmed. The MF910S product's one-click upgrade tool can obtain the Telnet remo...
[SECURITY] [DSA 4544-1] unbound security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4544-1 [email protected] https://www.debian.org/security/ Sebastien Delafond October 16, 2019 https://www.debian.org/security/faq -...
CVE-2019-17379
cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface SEC-527...
CVE-2019-17377
cPanel before 82.0.15 allows self XSS in LiveAPI example scripts SEC-524...
CVE-2019-17376
cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface SEC-521...
Design/Logic Flaw
cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface SEC-526...
CVE-2019-17380
CVE-2019-17380 affects cPanel's WHM Update Preferences interface, where versions prior to 82.0.15 are vulnerable to a self‑XSS due to lack of proper validation of client‑side data. The issue arises within the WHM Update Preferences UI and can lead to execution of client‑side code, as described ac...
CVE-2019-17379
cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface SEC-527...
CVE-2019-17378
cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface SEC-526...
CVE-2019-17376
cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface SEC-521...
CVE-2019-17376
CVE-2019-17376 affects cPanel prior to 82.0.15, where the SSL Certificate Upload interface is vulnerable to self-XSS due to insufficient validation in client-side data handling. Multiple sources confirm the flaw exists in the SSL Certificate Upload feature and is tied to versions older than 82.0....
LimeSurvey 3.17.13 - Cross-Site Scripting
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Stored and reflected XSS vulnerabilities product: LimeSurvey vulnerable version: 3.17.14 CVE number: CVE-2019-16172, CVE-2019-16173 impact: medium homepage:...
Zyxel Gateway / Access Point External DNS Request Vulnerability
Some Zyxel Access Points are prone to an information disclosure vulnerability where external DNS requests can be made. This VT has been deprecated and replaced by various device specific VTs. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced...
Message Signature Bypass
Overview Versions of openpgp prior to 4.2.0 are vulnerable to Message Signature Bypass. The package fails to verify that a message signature is of type text. This allows an attacker to to construct a message with a signature type that only verifies subpackets without additional input such as...
SEC Investigating Data Leak at First American Financial Corp.
The U.S. Securities and Exchange Commission SEC is investigating a security failure on the Web site of real estate title insurance giant First American Financial Corp. that exposed more than 885 million personal and financial records tied to mortgage deals going back to 2003, KrebsOnSecurity has...