2714 matches found
Security Bulletin: Cross-site scripting vulnerability in Installation Verification Tool of WebSphere Application Server (CVE-2018-1643)
Summary There is a potential cross-site scripting vulnerability with the Installation Verification Tool of IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-1643 DESCRIPTION: The Installation Verification Tool of IBM WebSphere Application Server is vulnerable to cross-site...
Exploit for OS Command Injection in Exim
eximrce Simple python socket connection to test if exim is vu...
Cross site scripting
A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin...
Shopify: XSS on services.shopify.com
Hy security, i Got a stored xss in one of your sub-domain "services.shopify.com" steps: 1- Go to https://yourstore.myshopify.com/admin/apps/expertsmarketplace/servicesmarketplace 2- Then Go to All servicesMarketing and salesemail marketing Design custom email templates click select 3- fill al the...
PT-2019-11414 · Otrs +2 · Otrs +2
Name of the Vulnerable Software and Affected Versions: Open Ticket Request System OTRS versions 7.x through 7.0.6 Open Ticket Request System OTRS Community Edition versions 5.0.x through 5.0.35 Open Ticket Request System OTRS Community Edition versions 6.0.x through 6.0.17 Description: An issue w...
XenServer WLB - The connection was reset
When attempting to connecting a Pool to the WLB server, receiving an error "The connection to the WLB server was reset". The stunnel process is running and the WLB server was rebooted as a troubleshooting step, but the issue still occurs...
GitLab: DoS attack via comment on Issue
Summary There is no limit to the number of characters in the issue comments, which allows a DoS attack. The DoS attack affects both server-side and client-side. NOTE: This bug happens on GitLab.com. Steps to reproduce ▼Attack for Client-side 1. Sign in to GitLab. 2. Create a project as below: -...
ZEIT: Stored Cross-site scripting
Stored Cross-site Scripting in https://zeit.co the steps in the video Impact steal an accounts cookies and more...
Security Bulletin: A security vulnerability has been identified in IBM Java Runtime could affect DB2 Query Management Facility (CVE-2018-12547, CVE-2019-2426, CVE-2018-1890, CVE-2018-12549, CVE-2018-11212)
Summary An unspecified vulnerability has been identified in IBM Java Runtime that could affect Db2 Query Management Facility. Vulnerability Details CVEID: CVE-2018-12547 CVSS Base Score: 9.8 DESCRIPTION: A widely used function in the OpenJ9 JVM is vulnerable to buffer overlows. Multiple Java...
Intel Firmware Vulnerabilities - Lenovo Support US
No description provided...
Semmle: Authenticated Cross-Site-Request-Forgery
Summary: I have read the T&C to be eligible for bounty on this program. As per T&C authenticated CSRF requests are eligible for a bounty. I am not looking for the Bounty, However I want to give you an update on Authenticated CSRF that I have found. In the "Account Settings", a user can change his...
Rocket.Chat: Guest Privilege Escalation to admin group
The vulnerability allowed a guest user to escalate privileges to the admin group. The guest user first added themselves to the bot group, which had the "manage-own-integrations" permission. Using this, the user created a malicious integration script that added the user to the admin group. The...
Notepad++: Command injection by setting a custom search engine
Summary: Arbitrary commands can be injected when using the "Search on Internet" function with a malicious custom search engine. The custom search engine can be set through the GUI or the config files, with different attack scenarios. Description: The "Search on Internet" context menu functionalit...
PT-2019-1904 · Dovecot +5 · Dovecot +5
Name of the Vulnerable Software and Affected Versions: Dovecot versions prior to 2.2.36.3 Dovecot versions 2.3.x prior to 2.3.5.1 Description: The issue is related to a lack of buffer size checks when reading FTS or POP3-UIDL headers from a Dovecot pointer. This can be exploited by a local attack...
AMAC Address Change 5.4 - Denial of Service Exploit
Exploit Title: a-Mac Address Change v5.4 - Denial of Service PoC Discovery by: Rafael Pedrero Vendor Homepage: http://amac.paqtool.com/ Software Link : http://amac.paqtool.com/ Tested Version: 5.4 Tested on: Windows XP SP3 Vulnerability Type: Denial of Service DoS Local Buffer Overflow Steps to...
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Rational ClearQuest (CVE-2018-1643)
Summary IBM WebSphere Application Server WAS is shipped as a component of IBM Rational ClearQuest. Information about a security vulnerability affecting WAS has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...
GROWI vulnerable to cross-site scripting
Overview GROWI provided by WESEEK, Inc. contains a cross-site scripting vulnerability CWE-79. The settings option for enabling and disabling the measures against cross-site scripting "Enable XSS prevention" option was introduced in v3.1.12. However, there was an issue with the implementation wher...
RATELIMITED: Hackerone1
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: add summary of the vulnerabili...
Guinea Pig and Vulnerability Management products
IMHO, security vendors use the term "Vulnerability Management" extremely inaccurate. Like a guinea pig, which is not a pig and is not related to Guinea, the current Vulnerability Management products are not about the actual practically exploitable vulnerabilities and not really about the...