Security feature bypass

A security restriction bypass vulnerability has been discovered in Revive Adserver version 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many other applications, requires the logged in user to type the current password in order to change the e-mail address or the password. It was howev...

CVE-2020-4303

IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

PT-2020-05: Cross-site scripting (XSS) in F5 Traffic Management User Interface (TMUI)

The vulnerability allows remote attackers to execute malicious JavaScript code in the context of the current user. If the logged-on user has administrative rights and Advanced Shell bash access, an attacker who successfully exploited the vulnerability could fully compromise the BIG-IP system...

PT-2020-04: Arbitrary code execution in F5 Traffic Management User Interface (TMUI)

The vulnerability allows unauthorized remote attackers to execute malicious code on the system, obtain sensitive information, or hijack traffic, as well as use the server with the Traffic Management User Interface TMUI for attacks on other internal resources of the target organization. Advisory...

IBM Tivoli Netcool Impact Cross-Site Scripting Vulnerability (CNVD-2020-19258)

IBM Tivoli Netcool Impact is a suite of network management software from IBM in the United States. The software has the ability to automate business-critical functions and provide a platform that provides unified access to real-time data, events and indicators. A cross-site scripting vulnerabilit...

CVE-2019-4681

IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force I...

IBM Jazz for Service Management Cross-Site Scripting Vulnerability (CNVD-2020-19257)

IBM Jazz for Service Management is an integrated service management product from IBM that provides visibility into the service management environment. A cross-site scripting vulnerability exists in IBM Jazz for Service Management version 1.1.3. A remote attacker can exploit this vulnerability to...

IBM Jazz for Service Management Cross-Site Scripting Vulnerability

IBM Jazz for Service Management is an integrated service management product from IBM that provides visibility into the service management environment. A cross-site scripting vulnerability exists in IBM Jazz for Service Management version 1.1.3. A remote attacker can exploit this vulnerability to...

Cisco SD-WAN Solution vManage Cross-Site Scripting Vulnerability

Cisco SD-WAN Solution is a set of network extension solutions from Cisco. vManage is a network management system. A cross-site scripting vulnerability exists in the Web UI in Cisco SD-WAN Solution vManage Releases prior to 19.2.2, which stems from the program failing to adequately validate...

IBM Tivoli Workload Scheduler Cross-Site Scripting Vulnerability

IBM Tivoli Workload Scheduler is a suite of enterprise task scheduling software from IBM in the United States. The software supports planning, executing and tracking jobs across multiple platforms and environments. A cross-site scripting vulnerability exists in IBM Tivoli Workload Scheduler versi...

CVE-2019-16010

A vulnerability in the web UI of the Cisco SD-WAN vManage software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the vManage software. The vulnerability is due to insufficient validation of...

PT-2020-2124 · Cisco · Cisco Sd-Wan Vmanage

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage software affected versions not specified Description: The issue is related to a cross-site scripting XSS attack in the web UI of the Cisco SD-WAN vManage software. This is due to insufficient validation of user-supplied...

Security Bulletin: Vulnerabilities in IBM WebSphere Application Server Liberty affect IBM Spectrum Protect Backup-Archive Client web user interface, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments

Summary Security vulnerabilities in WebSphere Application Server Liberty, such as spoofing, obtaining sensitive information, and bypassing security restrictions, affect IBM Spectrum Protect Backup-Archive Client web user interface, IBM Spectrum Protect for Space Management, and IBM Spectrum Prote...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF vulnerability in the user interface of Fortinet FortiSIEM 5.2.5 could allow a remote, unauthenticated attacker to perform arbitrary actions using an authenticated user's session by persuading the victim to follow a malicious link...

FortiSIEM is vulnerable to a CSRF attack

A Cross-Site Request Forgery CSRF vulnerability in the user interface of FortiSIEM could allow a remote, unauthenticated attacker to perform arbitrary actions using an authenticated user's session by persuading the victim to follow a malicious link...

Debian DSA-4638-1 : chromium - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2019-19880 Richard Lorenz discovered an issue in the sqlite library. - CVE-2019-19923 Richard Lorenz discovered an out-of-bounds read issue in the sqlite library. - CVE-2019-19925 Richard Lorenz discovered an issue in...

CVE-2019-4608

IBM Tivoli Workload Scheduler 9.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168508...

KLA11687 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Microsoft Word can be...

KLA11685 Spoofing vulnerability in Microsoft Exchange Server

A spoofing vulnerability was found in Microsoft Exchange Server. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2020-0903 Related products Microsoft-Exchange-Server CVE list CVE-2020-0903 warning KB list 4540123 Solution Install necessary updates...

KLA11689 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, execute arbitrary code, spoof user interface, cause denial of service. Below is a complete list of vulnerabilities: 1. An elevation of...