9727 matches found
CVE-2020-24432
Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier and Adobe Acrobat Pro DC 2017.011.30175 and earlier are affected by an improper input validation vulnerability that could result in arbitrary JavaScript execution in the context of the...
[SECURITY] Fedora 33 Update: trousers-0.3.14-4.fc33
TrouSerS is an implementation of the Trusted Computing Group's Software Sta ck TSS specification. You can use TrouSerS to write applications that make u se of your TPM hardware. TPM hardware can create, store and use RSA keys securely without ever being exposed in memory, verify a platform's soft...
CVE-2020-10776
A flaw was found in Keycloak, where it is possible to add unsafe schemes for the redirecturi parameter. This flaw allows an attacker to perform a Cross-site scripting attack. Mitigation Trusted Hosts Policy could be used to mitigate this attack :...
httpd: null-pointer dereference in mod_remoteip
A vulnerability was discovered in Apache httpd, in modremoteip. A trusted proxy using the "PROXY" protocol could send specially crafted headers that can cause httpd to experience a stack buffer overflow or NULL pointer dereference, leading to a crash or other potential consequences. This issue...
libreoffice: 'stealth mode' remote resource restrictions bypass
LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed...
spamassassin: crafted configuration files can run system commands without any output or errors
In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party ....
spamassassin: command injection via crafted configuration file
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration .cf files can be configured to run system commands similar to CVE-2018-11805. With this bug unpatched, exploits can be injected in a number of scenarios including the same...
CVE-2020-24432
Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier and Adobe Acrobat Pro DC 2017.011.30175 and earlier are affected by an improper input validation vulnerability that could result in arbitrary JavaScript execution in the context of the...
Client-Side Protection is Key to Web Application Security
The Open Web Application Security Project OWASP Foundation defines script attacks as a "type of injection in which malicious scripts are injected into otherwise benign and trusted websites."1 From the perspective of the user, malicious code is coming from trusted websites. Recently popularized by...
Apache Synapse < 3.0.1 Remote Code Execution Vulnerability
All Apache Synapse releases previous to 3.0.1 installed on the remote host are affected by a Remote Code Execution vulnerability. This can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 commons-collections-3.2.1.jar or previous...
EulerOS 2.0 SP5 : mailman (EulerOS-SA-2020-2291)
According to the version of the mailman package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted...
inoERP form personalization module command execution
Added: 10/28/2020 Background inoERP is an open source web based enterprise management system. Problem A vulnerability in the formpersonalization module allows remote, unauthenticated attackers to execute arbitrary PHP code injected in the templatecode parameter. Resolution No fix is available at...
PT-2020-6960 · Reportlab +2 · Reportlab +2
Name of the Vulnerable Software and Affected Versions: reportlab versions prior to the version with the fix Description: The issue is related to Server-side Request Forgery SSRF via img tags. It allows a remote attacker to access confidential data due to insufficient request validation. To reduce...
PT-2020-20819 · Apple · Macos Catalina +4
Name of the Vulnerable Software and Affected Versions: iOS versions prior to 13.6 iPadOS versions prior to 13.6 macOS Catalina versions prior to 10.15.6 tvOS versions prior to 13.4.8 watchOS versions prior to 6.2.8 Description: A certificate validation issue existed when processing...
CVE-2020-4748
IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188517...
CVE-2020-4755
IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188595...
Cross site scripting
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 and IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...
Cross site scripting
IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188595...
CVE-2020-4755
IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188595...
CVE-2020-4748
CVE-2020-4748 concerns IBM Spectrum Scale 5.0.0–5.0.5.2, where the Web UI is vulnerable to cross-site scripting, allowing arbitrary JavaScript in a trusted session and potential credential disclosure. The IBM bulletin confirms the affected range and notes a remediation: upgrade to code levels 5.0...