Cross-Site Scripting

Overview @progress/kendo-angular-editor before version 1.2.3 is vulnerable to Cross-Site Scripting. When the Editor content contains potentially malicious scripts in element event handlers, they get executed. Adding the following content to the Editor value demonstrates the issue: . Recommendatio...

Intel® LED Manager for NUC Advisory

Summary: A potential security vulnerability in the Intel® LED Manager for NUC may allow denial of service. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2020-8685 Description: Improper authentication in subsystem for Intel R LED...

CVE-2018-1682

IBM Watson Studio Local 1.2.3 could disclose sensitive information over the network that an attacked could use in further attacks against the system. IBM X-Force ID: 145238...

GoPro GPMF-parser heap buffer overflow vulnerability (CNVD-2020-03706)

GoPro gpmf-parser is a GPMF format telemetry data parser for use in GoPro cameras from GoPro USA. A buffer overflow vulnerability exists in the 'GPMFNext' function of the GPMFparser.c file in GoPro GPMF-parser version 1.2.3. The vulnerability stems from a networked system or product performing...

IBM Watson Studio Local Local Secret Key Storage Vulnerability

IBM Watson Studio Local is a suite of collaborative data processing solutions from IBM, USA. The product includes features such as data analysis, data visualization, data cleansing and streaming data extraction. A security vulnerability exists in IBM Watson Studio Local version 1.2.3, which...

IBM Watson Studio Local Information Disclosure Vulnerability

IBM Watson Studio Local is a suite of collaborative data processing solutions from IBM, USA. The product includes features such as data analysis, data visualization, data cleansing and streaming data extraction. A security vulnerability exists in IBM Watson Studio Loca version 1.2.3. An attacker...

Security Bulletin: Vulnerabilities in Apache Commons Compress affects IBM Watson Studio Local

Summary Vulnerabilities in Apache Commons Compress affects IBM Watson Studio Local Vulnerability Details CVEID: CVE-2019-12402 DESCRIPTION: The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted...

Security Bulletin: Multiple Vulnerabilities in OpenSSL affects IBM Watson Studio Local

Summary Multiple vulnerabilities in OpenSSL affects IBM Watson Studio Local Vulnerability Details CVEID: CVE-2019-1563 DESCRIPTION: In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of...

Security Bulletin: Input Validation Vulnerability in Watson Studio Local

Summary A lack of input validation offered an attack vector in several API calls. This vulnerability is addressed Vulnerability Details Third Party Entry: PSIRT-ADV0011811 DESCRIPTION: CVSS Base score: 8.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products and Versions...

Prototype Pollution

Overview Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument...

CVE-2019-13506

@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS...

Cacti < 1.2.3 XSS Vulnerability - Windows

Cacti is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Synology File Station Information Disclosure Vulnerability

Synology File Station is a set of file management tools from Synology Inc. of Taiwan, China. The tool enables users to access files on Synology NAS devices via the Web. An information disclosure vulnerability exists in SYNO.FolderSharing.List in Synology File Station versions prior to 1.2.3-0252...

CVE-2018-13298

Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors...

Joomla! Component Easy Shop 1.2.3 - Local File Inclusion

Joomla! Component Easy Shop 1.2.3 - Local File Inclusion Exploit Title: Joomla! Component Easy Shop 1.2.3 - Local File Inclusion Dork: N/A Date: 2019-01-22 Exploit Author: Ihsan Sencan Vendor Homepage: https://joomtech.net/ Software D.:...

Joomla! Component Easy Shop 1.2.3 - Local File Inclusion

Exploit Title: Joomla! Component Easy Shop 1.2.3 - Local File Inclusion Dork: N/A Date: 2019-01-22 Exploit Author: Ihsan Sencan Vendor Homepage: https://joomtech.net/ Software D.: https://www.joomtech.net/products/easyshop?task=file.download&key=7bafaa65995fb3b1383328105df1e10f Software Link:...

Cross-Site Scripting in sanitize-html

Affected versions of sanitize-html are vulnerable to cross-site scripting. Proof of Concept: produces the following: This is definitely invalid HTML, but would suggest that it's being interpreted incorrectly by the parser. Recommendation Update to version 1.2.3 or later...

WordPress Support Board Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Support Board Plugin is used in one of the online customer service chat plugin. A cross-site scripting vulnerabili...

WordPress Plugin Support Board 1.2.3 - Cross-Site Scripting

WordPress Plugin Support Board 1.2.3 - Cross-Site Scripting Exploit Title: Wordpress Plugin Support Board 1.2.3 - Cross-Site Scripting Date: 2018-10-16 Exploit Author: Ismail Tasdelen Vendor Homepage: https://schiocco.com/ Software Link : https://board.support/ Software : Support Board - Chat And...

CVE-2018-5378

The Quagga BGP daemon bgpd prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash...