CVE-2017-9384

The CVE-2017-9384 entry concerns Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device firmware includes relay.sh, a script used for establishing relay ports and Vera server communication. A parameter named remote_host is not sanitized and is concatenated into a subsequent script call via...

CVE-2019-4136

IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

chromium-browser: Inconsistent security UI placement

Incorrect dialog box scoping in browser in Google Chrome on Android prior to 75.0.3770.80 allowed a remote attacker to display misleading security UI via a crafted HTML page...

PT-2019-16917 · Ibm · Ibm Cognos Controller

Name of the Vulnerable Software and Affected Versions: IBM Cognos Controller versions 10.2.0 through 10.4.0 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

CVE-2019-4403

IBM Connections 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162264...

Cisco IOS XE Cross-Site Request Forgery Vulnerability

Cisco IOS XE is the United States Cisco Cisco company's set of operating system developed for its network equipment. A cross-site request forgery vulnerability exists in the web UI in Cisco IOS XE. The vulnerability stems from the WEB application not adequately verifying that the request is from ...

PT-2019-17065 · Ibm · Ibm Connections

Name of the Vulnerable Software and Affected Versions: IBM Connections version 6.0 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. This is due to a...

CVE-2019-3411

All versions up to BDR218V2.4 of ZTE MF920 product are impacted by information leak vulnerability. Due to some interfaces can obtain the WebUI login password without login, an attacker can exploit the vulnerability to obtain sensitive information about the affected components...

KLA11498 OSI vulnerability in Mozilla Firefox

Unspecified vulnerability was found in Mozilla Firefox. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories mfsa2019-16 Related products Mozilla-Firefox CVE list CVE-2019-11702 warning Solution Update to the latest version Download Mozilla Firefox...

KLA11501 Security UI vulnerability in Microsoft Developer Tools

A spoofing vulnerability was found in Microsoft Developer Tools. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2019-0996 Related products Microsoft-Azure CVE list CVE-2019-0996 warning KB list Solution Install necessary updates from the KB section...

PT-2019-16879 · Ibm · Ibm Intelligent Operations Center

Name of the Vulnerable Software and Affected Versions: IBM Intelligent Operations Center IOC versions 5.1.0 through 5.2.0 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure...

TheHive Elevation of Privilege Vulnerability

TheHive is a scalable open source security incident response platform. An elevation of privilege vulnerability exists in the User API in versions of TheHive prior to 2.13.4 and 3.x prior to 3.3.1, which can be exploited by an attacker with read-only or read/write access to escalate privileges to...

Cross-Site Scripting (XSS) in Verdaccio

Impact What kind of vulnerability is it? Who is impacted? Cross-Site Scripting XSS, malicious packages with content Javascript that might be executed in the User Interface stealing user credentials. Patches Has the problem been patched? What versions should users upgrade to? Users that still usin...

GHSA-78J5-GCMF-VQC8 Cross-Site Scripting (XSS) in Verdaccio

Impact What kind of vulnerability is it? Who is impacted? Cross-Site Scripting XSS, malicious packages with content Javascript that might be executed in the User Interface stealing user credentials. Patches Has the problem been patched? What versions should users upgrade to? Users that still usin...

CVE-2019-7393

A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x may allow a remote attacker to gain sensitive information in some cases...

Authentication flaw

A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x may allow a remote attacker to gain sensitive information in some cases...

Privilege escalation

A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where a...

Schneider Electric 1st Gen Pelco Sarix Enhanced Camera Command Injection Vulnerability (CNVD-2019-16259)

The Schneider Electric 1st Gen Pelco Sarix Enhanced Camera is a series of fixed IP cameras from Schneider Electric France. A command injection vulnerability exists in the web-based GUI in the Schneider Electric 1st Gen Pelco Sarix Enhanced Camera. The vulnerability stems from a network system or...

New browser extensions for integrating Microsoft’s hardware-based isolation

The hardware-based isolation technology on Windows 10 that allows Microsoft Edge to isolate browser-based attacks is now available as a browser extension for Google Chrome and Mozilla Firefox. We introduced the container technology in 2017. Since then, we have been evolving the technology and...

CVE-2019-11695

A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be used by a malicious site to trick users into clicking on permission prompts, doorhanger...