8806 matches found
PT-2019-17065 · Ibm · Ibm Connections
Name of the Vulnerable Software and Affected Versions: IBM Connections version 6.0 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. This is due to a...
Cisco IOS XE Cross-Site Request Forgery Vulnerability
Cisco IOS XE is the United States Cisco Cisco company's set of operating system developed for its network equipment. A cross-site request forgery vulnerability exists in the web UI in Cisco IOS XE. The vulnerability stems from the WEB application not adequately verifying that the request is from ...
CVE-2019-3411
All versions up to BDR218V2.4 of ZTE MF920 product are impacted by information leak vulnerability. Due to some interfaces can obtain the WebUI login password without login, an attacker can exploit the vulnerability to obtain sensitive information about the affected components...
KLA11498 OSI vulnerability in Mozilla Firefox
Unspecified vulnerability was found in Mozilla Firefox. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories mfsa2019-16 Related products Mozilla-Firefox CVE list CVE-2019-11702 warning Solution Update to the latest version Download Mozilla Firefox...
KLA11501 Security UI vulnerability in Microsoft Developer Tools
A spoofing vulnerability was found in Microsoft Developer Tools. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2019-0996 Related products Microsoft-Azure CVE list CVE-2019-0996 warning KB list Solution Install necessary updates from the KB section...
PT-2019-16879 · Ibm · Ibm Intelligent Operations Center
Name of the Vulnerable Software and Affected Versions: IBM Intelligent Operations Center IOC versions 5.1.0 through 5.2.0 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure...
TheHive Elevation of Privilege Vulnerability
TheHive is a scalable open source security incident response platform. An elevation of privilege vulnerability exists in the User API in versions of TheHive prior to 2.13.4 and 3.x prior to 3.3.1, which can be exploited by an attacker with read-only or read/write access to escalate privileges to...
Cross-Site Scripting (XSS) in Verdaccio
Impact What kind of vulnerability is it? Who is impacted? Cross-Site Scripting XSS, malicious packages with content Javascript that might be executed in the User Interface stealing user credentials. Patches Has the problem been patched? What versions should users upgrade to? Users that still usin...
GHSA-78J5-GCMF-VQC8 Cross-Site Scripting (XSS) in Verdaccio
Impact What kind of vulnerability is it? Who is impacted? Cross-Site Scripting XSS, malicious packages with content Javascript that might be executed in the User Interface stealing user credentials. Patches Has the problem been patched? What versions should users upgrade to? Users that still usin...
CVE-2019-7393
A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x may allow a remote attacker to gain sensitive information in some cases...
Authentication flaw
A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x may allow a remote attacker to gain sensitive information in some cases...
Privilege escalation
A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where a...
Schneider Electric 1st Gen Pelco Sarix Enhanced Camera Command Injection Vulnerability (CNVD-2019-16259)
The Schneider Electric 1st Gen Pelco Sarix Enhanced Camera is a series of fixed IP cameras from Schneider Electric France. A command injection vulnerability exists in the web-based GUI in the Schneider Electric 1st Gen Pelco Sarix Enhanced Camera. The vulnerability stems from a network system or...
New browser extensions for integrating Microsoft’s hardware-based isolation
The hardware-based isolation technology on Windows 10 that allows Microsoft Edge to isolate browser-based attacks is now available as a browser extension for Google Chrome and Mozilla Firefox. We introduced the container technology in 2017. Since then, we have been evolving the technology and...
CVE-2019-11695
A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be used by a malicious site to trick users into clicking on permission prompts, doorhanger...
CVE-2019-4011
IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155885...
PT-2019-16839 · Ibm · Ibm Bigfix Platform
Name of the Vulnerable Software and Affected Versions: IBM BigFix Platform versions 9.2 through 9.5 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...
[SECURITY] Fedora 28 Update: kernel-headers-5.0.16-100.fc28
Kernel-headers includes the C header files that specify the interface between the Linux kernel and userspace libraries and programs. The header files define structures and constants that are needed for building most standard programs and are also needed for rebuilding the glibc package...
Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation
The Linux kernel is vulerable to a use-after-free flaw when Transformation User configuration interfaceCONFIGXFRMUSER compile-time configuration were enabled. This vulnerability occurs while closing a xfrm netlink socket in xfrmdumppolicydone. A user/process could abuse this flaw to potentially...
