Fixed in Apache Tomcat 8.5.34

Moderate: Open Redirect CVE-2018-11784 When the default servlet returned a redirect to a directory e.g. redirecting to /foo/ when the user requested /foo a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice. This was fixed in revision...

team-international.com XSS vulnerability

Open Bug Bounty ID: OBB-673815 Description| Value ---|--- Affected Website:| team-international.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

RHEL 7 : qemu-kvm-rhev (RHSA-2016:0084)

Updated qemu-kvm-rhev packages that fix two security issues and three bugs are now available for Red Hat Enterprise Virtualization. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severit...

Portainer Cross-Site Scripting Vulnerability

Portainer is a lightweight user management interface for managing Docker environments and Docker hosts. A cross-site scripting vulnerability exists in Portainer 1.19.1 and earlier versions, which can be exploited by remote attackers to inject arbitrary JavaScript code and or HTML with the help of...

Cross-site Scripting (XSS)

github.com/portainer/portainer is vulnerable to cross-site scripting XSS attacks. The library does not use HTTP Secure Headers, allowing a malicious user to inject and execute arbitrary Javascript through the Team Name field...

CVE-2018-16371

PESCMS Team 2.2.1 has multiple reflected XSS via the keyword parameter: g=Team&m=User&a=index&keyword=, g=Team&m=Usergroup&a=index&keyword=, g=Team&m=Department&a=index&keyword=, and g=Team&m=Bulletin&a=index&keyword=...

CVE-2018-16370

In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive...

Code injection

In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive...

CVE-2018-16371

PESCMS Team 2.2.1 has multiple reflected XSS via the keyword parameter: g=Team&m=User&a=index&keyword=, g=Team&m=Usergroup&a=index&keyword=, g=Team&m=Department&a=index&keyword=, and g=Team&m=Bulletin&a=index&keyword=...

CVE-2018-16370

In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive...

CVE-2018-16371

CVE-2018-16371 affects PESCMS Team 2.2.1 and involves multiple reflected XSS via the keyword parameter in four endpoints: g=Team&m=User&a=index&keyword=, g=Team&m=User_group&a=index&keyword=, g=Team&m=Department&a=index&keyword=, and g=Team&m=Bulletin&a=index&keyword=. The provided documents iden...

CVE-2018-16371

PESCMS Team 2.2.1 has multiple reflected XSS via the keyword parameter: g=Team&m=User&a=index&keyword=, g=Team&m=Usergroup&a=index&keyword=, g=Team&m=Department&a=index&keyword=, and g=Team&m=Bulletin&a=index&keyword=...

CVE-2018-16370

The vulnerability CVE-2018-16370 affects PESCMS Team 2.2.1. An attacker can upload and execute arbitrary PHP code by placing a .php file inside a ZIP archive and submitting via /Public/?g=Team&m=Setting&a=upgrade, enabling remote code execution with network access. Exploit details, affected versi...

libreoffice/xlsfuzzer: Container-overflow in ScDPResultDimension::LateInitFrom

Detailed report: https://oss-fuzz.com/testcase?key=5694719535874048 Project: libreoffice Fuzzer: afllibreofficexlsfuzzer Fuzz target binary: xlsfuzzer Job Type: aflasanlibreoffice Platform Id: linux Crash Type: Container-overflow READ 4 Crash Address: 0x603000253634 Crash State:...

Cross site scripting

A stored Cross-site scripting XSS vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field...

CVE-2018-16316

A stored Cross-site scripting XSS vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field...

CVE-2018-16316

A stored Cross-site scripting XSS vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field...

CVE-2018-16316

A stored Cross-site scripting XSS vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field...

imagemagick/encoder_mvg_fuzzer: Heap-buffer-overflow in DrawDashPolygon

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5640076797673472 Project: imagemagick Fuzzer: aflimagemagickencodermvgfuzzer Fuzz target binary: encodermvgfuzzer Job Type: aflasanimagemagick Platform Id: linux Crash Type:...

CVE-2017-15429

Inappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239.108 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...