3469 matches found
CVE-2017-15980
The vulnerability CVE-2017-15980 affects the US Zip Codes Database Script 1.0, where the SQL injection occurs via the state parameter in index.php?action=lookup-county&state=... The connected documents provide concrete details: attacker-supplied state input can be exploited (e.g., UNION-based pay...
Protecting Critical Infrastructure from Cyber Threats
October is National Cybersecurity Awareness Month, an annual campaign to raise awareness about cybersecurity. Building resilience in critical infrastructure is crucial to national security. The essential infrastructure systems that support our daily lives—such as electricity, financial...
CVE-2017-15980: Improper Neutralization of Special Elements used in an SQL Command
US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter...
WordPress Releases Security Update
WordPress versions prior to 4.8.3 are affected by a vulnerability. A remote attacker could exploit this vulnerability to obtain sensitive information. US-CERT encourages users and administrators to review the WordPress Security Release and upgrade to WordPress 4.8.3. This product is provided...
PT-2017-14335
Name of the Vulnerable Software and Affected Versions US Zip Codes Database Script version 1.0 Description The issue allows SQL Injection via the state parameter. Recommendations For version 1.0, avoid using the state parameter in the affected API endpoint until the issue is resolved. Restrict...
Apple Releases Multiple Security Updates
Apple has released security updates to address vulnerabilities in multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review Apple security pages for the following products and apply...
This Week in Security News
Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...
ingenico.com XSS vulnerability
Vulnerable URL: https://www.ingenico.com/contact-us/contact/thanks?hn:type=action&hn:ref=r5r2r2r1newsletter-subscription-component Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 82616 VIP website status:| No...
Google Releases Security Update for Chrome
Google has released Chrome version 62.0.3202.75 for Windows, Mac, and Linux. This version addresses a vulnerability that an attacker could exploit to cause a denial-of-service condition. US-CERT encourages users and administrators to review the Chrome Releases page and apply the necessary update...
KeystoneJS 4.0.0-beta.5 - Cross-Site Scripting
KeystoneJS 4.0.0-beta.5 - Cross-Site Scripting Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated Stored XSS Vendor Homepage: http://keystonejs.com/ Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prince Category: WEBAPPS Platform:...
KeystoneJS 4.0.0-beta.5 Unauthenticated Stored Cross Site Scripting Vulnerability
Exploit for jsp platform in category web applications Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated Stored XSS Vendor Homepage: http://keystonejs.com/ Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prince Category: WEBAPPS...
KeystoneJS 4.0.0-beta.5 Unauthenticated Stored Cross Site Scripting
Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated Stored XSS Vendor Homepage: http://keystonejs.com/ Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prince Category: WEBAPPS Platform: Node.js CVE: CVE-2017-15878 Vendor Description...
Cross site scripting
A cross-site scripting XSS vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature...
CVE-2017-15878
A cross-site scripting XSS vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature...
CVE-2017-15878
A cross-site scripting XSS vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature...
CVE-2017-15878
A cross-site scripting XSS vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature...
CVE-2017-15878
KeystoneJS prior to 4.0.0-beta.7 contains a cross-site scripting (XSS) flaw in fields/types/markdown/MarkdownType.js exposed via the Contact Us feature. Multiple sources (GHSA entry and exploit reports) describe this as an unauthenticated or remote-exploit path that can deliver arbitrary JavaScri...
CVE-2017-15878
A cross-site scripting XSS vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature...
Multiple Ransomware Infections Reported
US-CERT has received multiple reports of ransomware infections, known as Bad Rabbit, in many countries around the world. A suspected variant of Petya, Bad Rabbit is ransomware—malicious software that infects a computer and restricts user access to the infected machine until a ransom is paid to...
CVE-2017-15878: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature...