CVE-2018-1000407

A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins...

CVE-2018-1000407: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins...

Debian: Security Advisory (DLA-1627-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-1000631: Improper Neutralization of Special Elements used in an SQL Command

Battelle V2I Hub 3.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the tmx/TmxCtl/src/lib/PluginStatus.cpp and TmxControl::userinfo function, which could allow the attacker to view, add, modify or delete information in the back-end database...

Medium: python34, python36

Issue Overview: Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data...

WS-2018-0667

Harfbuzz in versions 1.7.0 to 2.2.0 is vulnerable to Crash in Stack-buffer-overflow in hbbsearchr, related to src/hb-ot-post-table.hh...

CVE-2018-5801: NULL Pointer Dereference

An error within the "LibRaw::unpack" function src/librawcxx.cpp in LibRaw versions prior to 0.18.7 can be exploited to trigger a NULL pointer dereference...

Denial Of Service (DoS)

libexiv2.so is vulnerable to denial of service. A heap-based buffer over-read in the function Exiv2::IptcData::printStructure in src/iptc.cpp allows a remote attacker to cause a denial of service condition...

PT-2018-3005

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.8.1 Description The issue is related to an integer overflow in the libssh2 library, which can be exploited by a remote attacker to execute arbitrary code on the client system when a user connects to a compromised SS...

WS-2018-0666

libgit2 in versions v0.12.0 to v0.27.7 is vulnerable to Heap-buffer-overflow in gitstrntol64, related to src/util.c...

CVE-2018-18909

xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view...

CVE-2018-18909

xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view...

CVE-2018-18909

xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view...

CVE-2018-18909

The CVE-2018-18909 entry applies to xhEditor (version 1.2.2). The underlying issue is a cross-site scripting (XSS) vulnerability: an attacker can inject JavaScript code in the SRC attribute of an IFRAME element within the editor’s source-code view. This is evidenced by multiple connected records ...

PT-2018-14716

Name of the Vulnerable Software and Affected Versions xhEditor version 1.2.2 Description The issue allows for cross-site scripting XSS attacks through JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view. Recommendations For xhEditor version 1.2.2, consid...

CVE-2018-18909: Improper Neutralization of Input During Web Page Generation

xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view...

WS-2018-0654

libgit2 in versions v0.17.0 to v0.27.7 is vulnerable to Heap-buffer-overflow in gitstrntol64, related to src/util.c...

Cross-Site Scripting (XSS)

angular-gettext is vulnerable to cross-site scripting. interpolationContext is passed to getString or getPlural functions in dist/angular-gettext.js and src/directive.js, which allows attackers to inject arbitrary Javascript code into a victim's browser when the attribute...

CVE-2018-18361

An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...

CVE-2018-18361: Improper Neutralization of Input During Web Page Generation

An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...