5460 matches found
CVE-2018-17697
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
Design/Logic Flaw
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
Cross-Site Scripting in Fluid ViewHelpers
Failing to properly encode user input, templates using built-in Fluid ViewHelpers are vulnerable to cross-site scripting...
Cacti < 1.2.0 Multiple XSS Vulnerabilities - Linux
Cacti is prone to multiple cross-site scripting vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cacti:cacti";...
Cacti Cross-Site Scripting Vulnerability (CNVD-2019-14550)
Cacti is an open source, web-based network monitoring and mapping tool, a front-end application designed for the data logging tool RRDtool. A cross-site scripting vulnerability in the 'Name' field of the colortemplates.php file in versions of Cacti prior to 1.2.0, which stems from the program's...
Cacti cross-site scripting vulnerability (CNVD-2019-14551)
Cacti is an open source, web-based network monitoring and mapping tool, a front-end application designed for the data logging tool RRDtool. A cross-site scripting vulnerability exists in the 'Vertical Label' field of the graphtemplates.php file in versions of Cacti prior to 1.2.0, which stems fro...
CVE-2018-20723
A cross-site scripting XSS vulnerability exists in colortemplates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color...
CVE-2018-20723
A cross-site scripting XSS vulnerability exists in colortemplates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color...
CVE-2018-20725
A cross-site scripting XSS vulnerability exists in graphtemplates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label...
UBUNTU-CVE-2018-20725
A cross-site scripting XSS vulnerability exists in graphtemplates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label...
UBUNTU-CVE-2018-20723
A cross-site scripting XSS vulnerability exists in colortemplates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color...
CVE-2018-20725
A cross-site scripting XSS vulnerability exists in graphtemplates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label...
CVE-2018-20725
A cross-site scripting XSS vulnerability exists in graphtemplates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label...
World Readable Data
tripleo-heat-templates contains a world readable data vulnerability. The library does not set the proper permissions during the creation of the ceph.client.openstack.keyring, allowing a local user to access the keyring to read or modify data. This vulnerability only affects setups with openstack...
Unsafe Lookup
ansible is vulnerable to unsafe lookups. The library does not wrap the jinja2 environment properly, resulting in the lookup results being rendered as unicode strings. This can result in arbitrary code being executed in the templates...
Spoofing Metadata Requests
tripleo-heat-templates is vulnerable to spoofing of metadata requests. It is due to having the bad default setting of a blank value for the NeutronMetadataProxySharedSecret parameter when it is deployed from the command line interface. Not setting the value to this parameter means Neutron does no...
Unauthenticated Access To Private Data
tripleo-heat-templates is susceptible to unauthenticated access to private data. The vulnerability is due to a flaw in the ordering of the staticweb middleware in the swiftproxy configuration pipeline generated from the tripleo-heat-templates package. The staticweb middleware should be put after...
CVE-2019-6267
CVE-2019-6267 concerns the WordPress plugin Premium WP Suite Easy Redirect Manager (version/build: 28.07-17) where an XSS flaw exists. The vulnerability arises from a crafted GET request that is mishandled during log viewing at the URI templates/admin/redirect-log.php, allowing arbitrary script H...
Updated python-django packages fix security vulnerability
An upstream patch has been backported to fix a security vulnerability in python-django. CVE-2019-3498: Content spoofing possibility in the default 404 page An attacker could craft a malicious URL that could make spoofed content appear on the default page generated by the...