WordPress: Self-XSS in WordPress Editor Link Modal

A self-xss was found in the link modal of the WordPress editor and fixed in the WordPress 4.8.2 release. Was a self-xss on the link modal and the WordPress team were very helpful and they made a patch for the bug happy to work with them :...

CVE-2017-8308

In Avast Antivirus before v17, an unprivileged user and thus malware or a virus can mark an arbitrary process as Trusted from the perspective of the Avast product. This bypasses the Self-Defense feature of the product, opening a door to subsequent attack on many of its components...

CVE-2017-8307

In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replace or delete arbitrary files. This vulnerability is exploitable by any unprivileged user when Avast Self-Defense is disabled. It is also...

Design/Logic Flaw

In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replace or delete arbitrary files. This vulnerability is exploitable by any unprivileged user when Avast Self-Defense is disabled. It is also...

CVE-2017-8308

In Avast Antivirus before v17, an unprivileged user and thus malware or a virus can mark an arbitrary process as Trusted from the perspective of the Avast product. This bypasses the Self-Defense feature of the product, opening a door to subsequent attack on many of its components...

Code injection

In Avast Antivirus before v17, an unprivileged user and thus malware or a virus can mark an arbitrary process as Trusted from the perspective of the Avast product. This bypasses the Self-Defense feature of the product, opening a door to subsequent attack on many of its components...

CVE-2017-8308

CVE-2017-8308 affects Avast Antivirus before v17. An unprivileged user can mark an arbitrary process as Trusted from Avast’s perspective, bypassing Self-Defense and enabling potential further compromise of Avast components. Primary impact reported is a bypass of Self-Defense; exploitation status ...

CVE-2017-8308

In Avast Antivirus before v17, an unprivileged user and thus malware or a virus can mark an arbitrary process as Trusted from the perspective of the Avast product. This bypasses the Self-Defense feature of the product, opening a door to subsequent attack on many of its components...

Weblate: Self XSS at translation page through Editor Link at demo.weblate.org

User input is not sanitized properly at Editor link causing self xss. Steps to reproduce 1 Navigate to https://demo.weblate.org/accounts/profile/preferences 2 Provide Editor link as javaScript:alertdocument.cookie;//confirm1; and click on Save 3 Navigate to English Translation page of the project...

CVE-2017-3592

Vulnerability in the Oracle Payables component of Oracle E-Business Suite subcomponent: Self Service Manager. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows high privileged attacker with network access...

CVE-2017-3555

Vulnerability in the Oracle iReceivables component of Oracle E-Business Suite subcomponent: Self Registration. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access...

Design/Logic Flaw

Vulnerability in the Oracle iReceivables component of Oracle E-Business Suite subcomponent: Self Registration. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access...

CVE-2016-1915

Multiple cross-site scripting XSS vulnerabilities in BlackBerry Enterprise Server 12 BES12 Self-Service before 12.4 allow remote attackers to inject arbitrary web script or HTML via the locale parameter to 1 mydevice/index.jsp or 2 mydevice/loggedOut.jsp...

Sql injection

Multiple SQL injection vulnerabilities in the com.rim.mdm.ui.server.ImageServlet servlet in BlackBerry Enterprise Server 12 BES12 Self-Service before 12.4 allow remote attackers to execute arbitrary SQL commands via the imageName parameter to 1 mydevice/client/image, 2 admin/client/image, 3...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in BlackBerry Enterprise Server 12 BES12 Self-Service before 12.4 allow remote attackers to inject arbitrary web script or HTML via the locale parameter to 1 mydevice/index.jsp or 2 mydevice/loggedOut.jsp...

CVE-2016-1915

The CVE-2016-1915 entry describes XSS vulnerabilities in BlackBerry BES12 Self-Service prior to 12.4. Affected component: the self-service web app; vulnerable via the locale parameter in mydevice/index.jsp and mydevice/loggedOut.jsp. Impact: remote injection of script/HTML. Root cause: cross-site...

Google just discovered a dangerous Android Spyware that went undetected for 3 Years

An Android version of one of the most sophisticated mobile spyware has been discovered that remained undetected for at least three years due to its smart self-destruction capabilities. Dubbed Chrysaor, the Android spyware has been used in targeted attacks against activists and journalists mostly ...

AVG Antivirus Code Injection Vulnerability

AVG Antivirus is prone to a code injection vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:avg:anti-virus";...

Airwatch 6.1.x / 6.4.x LDAP Injection

https://www.osisecurity.com.au/airwatch-self-service-portal-username-parameter-ldap-injection.html Date: 04-Apr-2017 Product: AirWatch Self Service MDM Versions affected: v6.1.x v6.4.x Vulnerability: LDAP injection Example: https://target/DeviceManagement/ URL accepts the following POST parameter...

[SECURITY] Fedora 26 Update: sscg-2.0.4-1.fc26

A utility to aid in the creation of more secure "self-signed" certificates. The certificates created by this tool are generated in a way so as to create a CA certificate that can be safely imported into a client machine to trust the service certificate without needing to set up a full PKI...