UBUNTU-CVE-2017-11737

interface/js/app/history.js in WebUI in Rspamd before 1.6.3 allows XSS via the Subject and Message-Id headers, which are mishandled in the history page...

CVE-2017-11737

interface/js/app/history.js in WebUI in Rspamd before 1.6.3 allows XSS via the Subject and Message-Id headers, which are mishandled in the history page...

DEBIAN-CVE-2017-11737

interface/js/app/history.js in WebUI in Rspamd before 1.6.3 allows XSS via the Subject and Message-Id headers, which are mishandled in the history page...

CVE-2017-11737

The vulnerability is CVE-2017-11737 affecting Rspamd's WebUI HISTORY page: interface/js/app/history.js, prior to version 1.6.3. The root cause is mishandling of the Subject and Message-Id headers, enabling cross-site scripting (XSS) in the History page. Impact is XSS leakage in the browser sessio...

CVE-2017-11737

interface/js/app/history.js in WebUI in Rspamd before 1.6.3 allows XSS via the Subject and Message-Id headers, which are mishandled in the history page...

CVE-2017-11737

interface/js/app/history.js in WebUI in Rspamd before 1.6.3 allows XSS via the Subject and Message-Id headers, which are mishandled in the history page...

CVE-2017-11181

In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the Messaging section. Subject and Message fields are vulnerable...

CVE-2017-11181

In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the Messaging section. Subject and Message fields are vulnerable...

Cross site scripting

In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the Messaging section. Subject and Message fields are vulnerable...

CVE-2017-11181

In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the Messaging section. Subject and Message fields are vulnerable...

Red Hat FreeIPA SubjectAltNames Improperly Checked Vulnerability

Red Hat FreeIPA is an integrated security information management solution from Red Hat, Inc. The solution provides an easy-to-manage identity, policy and audit IPA suite for Linux and Unix computer networks. A security vulnerability exists in Red Hat FreeIPA version 4.4.0. A remote attacker could...

Cuvva: Subdomain take over oh-no.cuvva.co and ohno.cuvva.co

Cuvva has an old EV certificate which lists a very large number of subject alternative names SANs, as listed below. These were included because we anticipated potentially wanting to use these hostnames in the future and it was free to add them. Very few of the hostnames actually exist, and those...

CVE-2016-4467

The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when using the SChannel-based security layer,...

CVE-2017-7723

XSS exists in Easy WP SMTP before 1.2.5, a WordPress Plugin, via the e-mail subject or body...

Multiple SQL Injection Vulnerabilities in Zaoyang City Shanshui Digital Website Building System

Zaoyang Shanshui digital website builder system is a website builder system. SQL injection vulnerability exists in the index.php and subject.php pages of the Zaoyang City Shanshui Digital website builder system, as the program fails to filter user-submitted data, allowing attackers to exploit the...

jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name

It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

CVE-2017-5673

In the Kunena extension 5.0.2 through 5.0.4 for Joomla!, the forum message subject aka topic subject accepts JavaScript, leading to XSS. Six files are affected: crypsis/layouts/message/item/default.php, crypsis/layouts/message/item/top/default.php, crypsis/layouts/message/item/bottom/default.php,...

CVE-2016-6890

Heap-based buffer overflow in MatrixSSL before 3.8.6 allows remote attackers to execute arbitrary code via a crafted Subject Alt Name in an X.509 certificate...

Contenido v4.9.11 - (Backend) Multiple XSS Vulnerabilities

Document Title: =============== Contenido v4.9.11 - Backend Multiple XSS Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1928 Release Date: ============= 2016-10-10 Vulnerability Laboratory ID VL-ID: ====================================...

FRticket Ticket System Stored Cross-Site Scripting Vulnerability

Frticket is a popular ticketing system. FRticket Ticket System subject parameter-stored cross-site scripting vulnerability. An attacker can inject malicious scripts via this vulnerability...