Xen Hypervisor Multiple Vulnerabilities (XSA-213 - XSA-215)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the getuser function due to permissions for accessing MMIO ranges being checked only after accessing them. A...

CVE-2017-8102

Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipityeventxsstrust plugin and a setconfig error in that plugin...

Watch Out! First-Ever Word Macro Malware for Apple Mac OS Discovered in the Wild

After targeting Windows-based computers over the past few years, hackers are now shifting their interest to Macs as well. The emergence of the first macro-based Word document attack against Apple's macOS platform is the latest example to prove this. The concept of Macros dates back to 1990s. You...

Honeywell XL Web II Controller Session Fixation Vulnerability

Honeywell XL Web Controller is a web-based SCADA system. A session fixation vulnerability exists in Honeywell XL Web II Controller, which can be exploited by an attacker to establish a new user session and steal authenticated sessions...

Cross-site Scripting (XSS)

jquery-migrate is vulnerable to Cross-site Scripting XSS. jquery-migrate uses code similar to $location.hash to select an ID value encoded on the page. However, an attacker can create a cross-site scripting injection by using a string similar to and run code to steal user data...

HP Integrated Lights-Out Cross-Site Scripting Vulnerability

HP Integrated Lights-Out is used for remote management of servers. A cross-site scripting vulnerability exists in HP Integrated Lights-Out. Due to the program failing to adequately filter user-supplied input. An attacker could exploit this issue to execute arbitrary HTML and script code in an...

CVE-2016-8504: Cross-Site Request Forgery (CSRF)

CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile...

Stored Cross-Site Scripting Vulnerability in Click Story App

Clicker Stories is an audiobook app for children. A stored cross-site scripting vulnerability exists in the Clicker Stories app. Allows an attacker to insert malicious scripts into input points where the vulnerability exists, to steal users' cookies or to realize phishing attacks...

Epoch Web Mailing List Cross-Site Scripting Vulnerability

Epoch Web Mailing List is a set of web mailing lists from Epoch Japan. Epoch Web Mailing List suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack a user's...

TYPO3 Cross-Site Scripting Vulnerability

TYPO3 is a free and open source content management system. TYPO3 suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when...

SAP NetWeaver AS JAVA XSS in portal app component

Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver AS Java RTC 7.0-7.3 Vendor URL: SAP Bugs: XSS Reported: 22.04.2016 Vendor response: 23.04.2016 Date of Public Advisory: 10.01.2017 Reference: SAP Security Note 2341302 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION...

Bank Trojans Nymaim, Gozi Merge Create GozNym

Two powerful Trojans, Nymaim and Gozi ISFB, have been combined to create a “double-headed beast” called GozNym. The Trojan has managed to steal $4 million since it was first discovered just two weeks ago, according to IBM X-Force Research. It reports the hybrid Trojan is currently engaged in an...

Atlassian Confluence Cross-Site Scripting Vulnerability

Atlassian Confluence is a professional enterprise knowledge management and collaboration software that can also be used to build enterprise WiKi. Atlassian Confluence suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious...

Let's PHP! Frame high-speed chat cross-site scripting vulnerability

Let's PHP! Frame high-speed chat is a chat system from Let's PHP! Let's PHP! Frame high-speed chat suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user...

Moodle cross-site scripting vulnerability (CNVD-2015-07728)

Moodle is a free, open source e-learning software platform. Moodle suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when...

MediaWiki cross-site scripting vulnerability (CNVD-2015-07394)

MediaWiki is a suite of free and freely available web-based wiki engines that can be used to deploy in-house knowledge management and content management systems. MediaWiki suffers from a cross-site scripting vulnerability that could be exploited by remote attackers to inject malicious script or...

MiniBB 3.1.1 Cross Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Product: MiniBB 3.1.1 Fixed in: 3.2 Fixed Version Link: http://www.minibb.com/download.php?file=minibb Vendor Contact: [email protected] Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor: 09/01/2015 Disclosed to...

IBM WebSphere eXtreme Scale Cross-Site Scripting Vulnerability

IBM WebSphere eXtreme Scale is a distributed caching solution. A cross-site scripting vulnerability exists in IBM WebSphere Extreme Scale, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information ...

Apache Struts Cross-Site Scripting Vulnerability

Apache Struts is an open source framework for creating enterprise Java Web applications. Apache Struts suffers from a cross-site scripting vulnerability when the JSP is directly accessible, allowing remote attackers to exploit the vulnerability to inject malicious script or HTML code that can be...

Microsoft repair SharePoint 2 0 1 3 XSS vulnerabilities-the vulnerabilities and early warning-the black bar safety net

SharePoint is the Microsoft Office Suite in a tool for individuals and companies to create a portal page. The vulnerabilityCVE-2 0 1 5-2 5 2 2by FortiNet's FortiGuard Labs security researchers discovered the vulnerability affects SharePoint 2 0 1 3 15.0.4571.1502 early version. SharePoint is a...