4718 matches found
Intel DCI Policy Update - US
Lenovo Security Advisory: LEN-23611 Potential Impact: Privilege escalation, information disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2018-3652 Summary Description: Intel is releasing Direct Connect Interface DCI policy update. Existing UEFI setting restrictions for...
CVE-2018-19531
HTTL aka Hyper-Text Template Language through 1.0.11 allows remote command execution because the decodeXml function uses java.beans.XMLEncoder unsafely when configured without an xml.codec= setting...
CVE-2018-19530
HTTL aka Hyper-Text Template Language through 1.0.11 allows remote command execution because the decodeXml function uses XStream unsafely when configured with an xml.codec=httl.spi.codecs.XstreamCodec setting...
CVE-2018-19464
Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...
Cloned Nimble volumes are not visible
Challenge By default, cloned Nimble Volumes are not shown in Veeam Backup and Replication UI and cannot be interacted with. However you can implement registry setting that will enable Nimble cloned volumes for interaction. Solution 1. Create the following registry value on the Veeam Backup and...
JPress Cross-Site Scripting Vulnerability
JPress is a set of blogging platform developed using the Java language. A cross-site scripting vulnerability exists in JPress version 1.0-rc.5, which can be exploited to inject arbitrary web script or HTML by sending the site name, site title, or site subtitle fields to the...
PT-2018-14839
Name of the Vulnerable Software and Affected Versions JPress version 1.0-rc.5 Description The issue concerns stored XSS that can be triggered via the first three input fields. This is demonstrated by the web name parameter in the "/starter-tomcat-1.0/admin/setting" API endpoint. Recommendations F...
CVE-2018-19170: Improper Neutralization of Input During Web Page Generation
In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the webname parameter...
Side-Channel Attack
libgnutls.so is vulnerable to plain text recovery via cache-based side channel. An attacker is able to use a combination of Just in Time Prime+probe and Lucky-13 attacks to recover plain text using crafted packets in a cross-VM setting...
Prayer Information Disclosure Vulnerability
Prayer is an IMAP-based Web mail server. An information disclosure vulnerability exists in Prayer that stems from the header.t lack of no-referrer setting. An attacker can exploit this vulnerability to obtain a username...
Design/Logic Flaw
Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer setting...
CVE-2018-18655
Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer setting...
CVE-2018-18655
Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer setting...
CVE-2018-18655
Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer setting...
Leanote cross-site scripting vulnerability (CNVD-2018-21793)
Leanote is an open source notepad application. A cross-site scripting vulnerability exists in the Blog Basic Setting page in Leanote version 2.6.1. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the title field...
Design/Logic Flaw
Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page...
CVE-2018-18553
Leanote 2.6.1 is affected by a cross-site scripting (XSS) vulnerability in the Blog Basic Setting title field, exploitable via rendering of the Likes page. The issue stems from mishandling the title field during page rendering, allowing injected scripts/HTML to execute in affected contexts. Pub...
CVE-2018-18553: Improper Neutralization of Input During Web Page Generation
Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page...
PT-2018-14512
Name of the Vulnerable Software and Affected Versions Leanote version 2.6.1 Description The issue concerns a mishandling of the title field in the Blog Basic Setting during the rendering of the "likes" page, leading to an XSS issue. Recommendations For Leanote version 2.6.1, update to a version...