Threat Round-up for Aug 11 - Aug 18

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between August 11 and August 18. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior...

openSUSE Security Update : fossil (openSUSE-2017-949)

This update for fossil to version 2.3 fixes the following issues : - Potential XSS vulnerability on the /help webpage boo1053267 This update also contains all upstream improvements and fixes in version 2.3 : - Update internal Unicode character tables, used in regular expression handling, from...

CVE-2017-12649: Improper Neutralization of Input During Web Page Generation

XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary web script through the course summary field on the course request pending approval page...

divecomputertraining.com XSS vulnerability

Vulnerable URL: http://www.divecomputertraining.com/diveComputersSummary.php?type=dive=both==all=wrist=all=digital=1"...

Product update: Virtuozzo Automator 7.0 Update 2 Hotfix 2 (VA MN: 7.0.2-403, VA Agent: 7.0.2-189)

This hotfix for Virtuozzo Automator 7.0.2 provides stability and usability bug fixes. Vulnerability id: PVA-37045 The Management Node did not recognize bonded network during VLAN creation. Vulnerability id: PVA-37041 Could not create virtual network for a VLAN created by the Virtuozzo installer...

RubyGems: No limit of summary length allows Denail of Service

Currently, there is no limit for summary length. I think, pushing a gem whose summary is huge, will make gem search unavailable. This is not Arbitrary Code Execution, but really easy to attack. According to CVSS v3.0 Calculator, the severity is High 7.5. How to attack 1 An attacker creates a gem...

Microsoft Releases June 2017 Security Updates

Microsoft has released updates to address vulnerabilities in Microsoft software. A remote attacker could exploit some of these vulnerabilities to take control of a system. US-CERT encourages users and administrators to review Microsoft's June 2017 Security Update Summary and Deployment Informatio...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting attacks. These attacks are possible through the course summary filter on the Add a new course page by passing an attribute to it. Note: This is not going to be fixed by the Moodle team...

anebooks.com XSS vulnerability

Vulnerable URL: http://www.anebooks.com/summary-booklist.asp?from=search==91=0====1%22%27%20Style=position:fixed;top:0;left:0;font-size:999px;%20Onmouseenter=confirmOPENBUGBOUNTY%20//=0==3 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XS...

Moodle cross-site scripting vulnerability (CNVD-2017-04602)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A cross-site scripting vulnerability exists in the Course summary filter on the 'Add a...

Design/Logic Flaw

In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element...

CVE-2017-7298

In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element...

CVE-2017-7298

In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element...

CVE-2017-7298

In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element...

CVE-2017-7298

In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element...

CVE-2017-7298

CVE-2017-7298 affects Moodle 3.2.2+ via a cross-site scripting vulnerability in the Course summary filter on the Add a new course page. The issue is triggered by crafted SVG attributes, enabling potential injection. Public details in connected documents reiterate the XSS in Moodle 3.2.2+ but do n...

CVE-2017-7298

In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element...

CVE-2017-7298: Improper Neutralization of Input During Web Page Generation

In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element...

PT-2017-17644

Name of the Vulnerable Software and Affected Versions Moodle versions 3.2.2 and later Description The issue concerns a Cross-Site Scripting XSS flaw in the Course summary filter of the "Add a new course" page. This is demonstrated by a crafted attribute of an SVG element, which can lead to the...