GHSA-Q2QW-RMRH-VV42 Improper Access Control in activejob

A Broken Access Control vulnerability in Active Job versions = 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have...

Secret Keeper - Python Script To Encrypt & Decrypt Files With A Given Key

Secret Keeper is a file encryptor written in python which encrypt your files using Advanced Encryption Standard AES. CBC Mode is used when creating the AES cipher wherein each block is chained to the previous block in the stream. Features Secret Keeper has the ability to generate a random...

CVE-2018-16476

A Broken Access Control vulnerability in Active Job versions = 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1,...

CVE-2018-16476

A Broken Access Control vulnerability in Active Job versions = 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1,...

CVE-2018-18987

VT-Designer Version 2.1.7.31 is vulnerable by the program populating objects with user supplied input via a file without first checking for validity, allowing attacker supplied input to be written to known memory locations. This may cause the program to crash or allow remote code execution...

Micro Focus Secure Messaging Gateway SQL Injection (CVE-2018-12464)

A SQL injection vulnerability exists in Micro Focus Secure Messaging Gateway. The vulnerability is due to insufficient validation of user input. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Broken Access Control vulnerability in Active Job

There is a vulnerability in Active Job. This vulnerability has been assigned the CVE identifier CVE-2018-16476. Versions Affected: = 4.2.0 Not affected: 4.2.0 Fixed Versions: 4.2.11, 5.0.7.1, 5.1.6.1, 5.2.1.1 Impact ------ Carefully crafted user input can cause Active Job to deserialize it using...

Cross-Site Scripting in extension "libconnect" (libconnect)

The extension fails to properly encode user input for output in HTML context...

Microsoft Team Foundation Server Cross-Site Scripting Vulnerability

Microsoft Team Foundation Server is a source code management, project management and team collaboration platform within the Application Lifecycle Management ALM suite of tools from Microsoft. The platform helps teams collaborate more flexibly and effectively and deliver high-quality software more...

Cross site scripting

A Cross-site Scripting XSS vulnerability exists when Azure App Services on Azure Stack does not properly sanitize user provided input, aka "Azure App Service Cross-site Scripting Vulnerability." This affects Azure App...

WordPress Plugin 'WP GDPR Compliance' < 1.4.3 Privilege Escalation

The WordPress application running on the remote host has a version of the 'WP GDPR Compliance' plugin that is prior to 1.4.3 and, thus, is affected by a user-input validation error that can allow privilege escalation attacks. Such attacks allow, among other actions, creation of new...

curl: Glob parser write/read out of bounds

The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input...

Azure App Service Cross-site Scripting Vulnerability

A Cross-site Scripting XSS vulnerability exists when Azure App Services on Azure Stack does not properly sanitize user provided input. An authenticated attacker could exploit the vulnerability by sending a specially crafted payload to the App Service, which will get executed in the context of the...

Microsoft Dynamics 365 CVE-2018-8608 Cross Site Scripting Vulnerability

Description Microsoft Dynamics 365 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may...

Microsoft Dynamics 365 CVE-2018-8605 Cross Site Scripting Vulnerability

Description Microsoft Dynamics 365 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may...

Microsoft SharePoint Server CVE-2018-8568 Remote Privilege Escalation Vulnerability

Description Microsoft SharePoint Server is prone to a remote privilege-escalation vulnerability because it fails to properly sanitize user-supplied input. An attacker may exploit this issue to gain elevated privileges. Successful exploits may aid in further attacks. Technologies Affected Microsof...

Microsoft Dynamics 365 CVE-2018-8607 Cross Site Scripting Vulnerability

Description Microsoft Dynamics 365 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may...

Microsoft Azure App Service CVE-2018-8600 Cross Site Scripting Vulnerability

Description Microsoft Azure App Service is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...

Cross-Site Scripting (XSS)

Apache Tomcat is vulnerable to cross-site scripting. The Host Manager Servlet does not sanitise user input via the aliases parameter before displaying the response on a user's browser. This allows remote attackers to inject arbitrary Javascript into a victim's browser to steal the session cookie ...

CVE-2018-15451

A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplie...