946 matches found
Threat Roundup for November 2 to November 9
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 02 and Nov. 09. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...
Nessus Launched Plugin List
This plugin displays the list of launched plugins in a semicolon delimited list. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid112154; scriptversion"1.4"; scriptcvsdate"Date: 2018/09/24 10:11:01"; scriptnameenglish:"Nessus Launched Plugin List";...
Cross-site Scripting (XSS)
primefaces is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of user sanitization of the value of summary in the fileUpload functionality...
Threat Roundup for June 22-29
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 22 and June 29. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristic...
Jenkins TestLink Plugin Cross-Site Scripting Vulnerability
Jenkins is an open source software project , is based on Java development of a continuous integration tool . A cross-site scripting vulnerability exists in TestLinkBuildAction/summary.jelly and other scripts in Jenkins TestLink Plugin 2.12 and earlier versions, which stems from a program that mak...
rubygems: Escape sequence in the "summary" field of gemspec
A vulnerability was found where rubygems did not properly sanitize gems' specification text. A specially crafted gem could interact with the terminal via the use of escape sequences...
rubygems: Escape sequence in the "summary" field of gemspec
A vulnerability was found where rubygems did not properly sanitize gems' specification text. A specially crafted gem could interact with the terminal via the use of escape sequences...
Qualys Cloud Suite 8.12 New Features
This new release of the Qualys Cloud Suite, version 8.12 adds new reporting options for the PC Report, allowing you to include new summaries in the remediation section of the report for control failures. Feature Highlights Qualys Policy Compliance PC/SCAP PC Report: Failure Summary Section – You...
Trend Micro Control Manager ContentSecuritySummary SQL Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Control Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...
rubygems: No size limit in summary length of gem spec
It was found that rubygems could use an excessive amount of CPU while parsing a sufficiently long gem summary. A specially crafted gem from a gem repository could freeze gem commands attempting to parse its summary...
HackerOne: Information Disclosure when /invitations/<token>.json is not yet accepted
Hi Team, Summary: First, i just want to clarify that this finding seems a purely human mistake from one of the hackerone member team who created a summary of this report: 283309 --- I have found that you guys HackerOne was disclosing email address and private program as part of this report summar...
Contributors Summary Macro Shows Data to Anonymous Users
h2. Steps to reproduce In Global Permission, ensure Anonymous users "Can Use" Confluence Create new Space , eg: SpaceA Go To Space Tools Permissions Edit Permission Ensure Anonymous Users has "View" Permission Create a few test pages in SpaceA Then, create a page containing both Contributors Macr...
Contributors Summary Macro Shows Data to Anonymous Users
h2. Steps to reproduce In Global Permission, ensure Anonymous users "Can Use" Confluence Create new Space , eg: SpaceA Go To Space Tools Permissions Edit Permission Ensure Anonymous Users has "View" Permission Create a few test pages in SpaceA Then, create a page containing both Contributors Macr...
[ASA-201709-5] tcpdump: multiple issues
Arch Linux Security Advisory ASA-201709-5 ========================================= Severity: Critical Date : 2017-09-13 CVE-ID : CVE-2017-11541 CVE-2017-11542 CVE-2017-11543 CVE-2017-12893 CVE-2017-12894 CVE-2017-12895 CVE-2017-12896 CVE-2017-12897 CVE-2017-12898 CVE-2017-12899 CVE-2017-12900...
CVE-2016-6800: Improper Neutralization of Input During Web Page Generation
The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not...
Threat Round-up for Aug 11 - Aug 18
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between August 11 and August 18. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior...
openSUSE Security Update : fossil (openSUSE-2017-949)
This update for fossil to version 2.3 fixes the following issues : - Potential XSS vulnerability on the /help webpage boo1053267 This update also contains all upstream improvements and fixes in version 2.3 : - Update internal Unicode character tables, used in regular expression handling, from...
CVE-2017-12649: Improper Neutralization of Input During Web Page Generation
XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display...
Cross-site Scripting (XSS)
Moodle is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary web script through the course summary field on the course request pending approval page...
