CVE-2018-8602

CVE-2018-8602 is a Cross-site Scripting (XSS) vulnerability in Team Foundation Server (TFS) where user input is not properly sanitized. The connected documents corroborate that an authenticated attacker could exploit this vulnerability by sending a crafted payload to TFS, resulting in script exec...

CVE-2018-8602

A Cross-site Scripting XSS vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross-site Scripting Vulnerability." This affects Team...

Team Foundation Server Cross-site Scripting Vulnerability

A Cross-site Scripting XSS vulnerability exists when Team Foundation Server does not properly sanitize user provided input. An authenticated attacker could exploit the vulnerability by sending a specially crafted payload to the Team Foundation Server, which will get executed in the context of the...

Team Foundation Server Remote Code Execution Vulnerability

A remote code execution vulnerability exists when Team Foundation Server TFS does not enable basic authorization on the communication between the TFS and Search services. Without basic authorization, an attacker could run certain commands on the Search service. The security update addresses the...

Microsoft Team Foundation Server CVE-2018-8602 Cross Site Scripting Vulnerability

Description Microsoft Team Foundation Server is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site...

Microsoft Team Foundation Server CVE-2018-8529 Remote Code Execution Vulnerability

Description Microsoft Team Foundation Server is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions. Technologies Affected Microso...

The AWS Exploitation Framework: Pacu

Pacu is an open source AWS exploitation framework, designed for offensive security testing against cloud environments. Created and maintained by Rhino Security Labs, Pacu allows penetration testers to exploit configuration flaws within an AWS account, using modules to easily expand its...

poppler/pdf_fuzzer: Crash in XRefEntry::setFlag

Project: https://anongit.freedesktop.org/git/poppler/poppler.git https://gitlab.freedesktop.org/poppler/poppler.git https://gitlab.freedesktop.org/ceyhunalp/poppler.git Detailed report: https://oss-fuzz.com/testcase?key=5668843268079616 Project: poppler Fuzzer: libFuzzerpopplerpdffuzzer Fuzz targ...

[SECURITY] Fedora 29 Update: NetworkManager-1.12.4-2.fc29

NetworkManager is a system service that manages network interfaces and connections based on user or automatic configuration. It supports Ethernet, Bridge, Bond, VLAN, Team, InfiniBand, Wi-Fi, mobile broadband WWAN, PPPoE and other devices, and supports a variety of different VPN services...

DarkSpiritz v2.0 - A Penetration Testing Framework For Linux, MacOS, And Windows Systems

A penetration testing framework for Linux and Windows systems. What is DarkSpiritz? Created by the SynTel Team it was a project of one of the owners to update and clean-up an older pentesting framework he had created to something updated and modern. DarkSpiritz is a re-vamp of the very popular...

Talos Vulnerability Discovery Year in Review - 2018

Introduction Cisco Talos' Vulnerability Discovery Team investigates software and operating system vulnerabilities in order to discover them before malicious threat actors. We provide this information to vendors so that they can create patches and protect their customers as soon as possible. We...

Cross site scripting

IBM Team Concert RTC 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IB...

CVE-2018-1766

IBM Team Concert RTC 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IB...

CVE-2018-1766

IBM Team Concert RTC 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IB...

CVE-2018-1766

IBM Team Concert (RTC) and Rational CLM are affected by a cross-site scripting (XSS) vulnerability in the Web UI for RTC versions 5.0–5.0.2 and 6.0–6.0.5 (6.0.6 iFix03 or later is the remediation). The underlying issue allows an attacker to embed arbitrary JavaScript, potentially altering functio...

CVE-2018-1766

IBM Team Concert RTC 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IB...

IBM Rational Team Concert and Rational Collaborative Lifecycle Management Cross-Site Scripting Vulnerability

IBM Rational Team Concert RTC and Rational Collaborative Lifecycle Management CLM are both collaborative lifecycle management solutions from IBM USA. A cross-site scripting vulnerability exists in IBM RTC and Rational CLM. A remote attacker can exploit this vulnerability to inject arbitrary...

mupdf/pdf_fuzzer: NULL

Detailed report: https://oss-fuzz.com/testcase?key=5658375946240000 Project: mupdf Fuzzer: aflmupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: aflasanmupdf Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: address ASAN Reproducer...

Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass)

Oracle Weblogic Server - Deserialization Remote Command Execution Patch Bypass // All respects goes to Zhiyi Zhang of 360 ESG Codesafe Team // URL: https://blogs.projectmoon.pw/2018/10/19/Oracle-WebLogic-Two-RCE-Deserialization-Vulnerabilities/ package ysoserial.payloads; import...

What You Should Look For in a Next-Generation Security Solution

Today’s businesses face a unique set of challenges. They want security that works and is easy to implement and manage but, frequently, are working with a limited budget and resources. Many organizations know their current antivirus solution has gaps, but don’t know where to begin in the search fo...