2836 matches found
CVE-2019-6507
An issue was discovered in creditease-sec insight through 2018-09-11. loginuserdelete in srcpm/app/admin/views.py allows CSRF...
CVE-2019-6510
An issue was discovered in creditease-sec insight through 2018-09-11. userdelete in srcpm/app/admin/views.py allows CSRF...
CVE-2017-6923
In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the...
Code injection
In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the...
CVE-2017-6923
In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the...
PT-2019-8594
Name of the Vulnerable Software and Affected Versions Drupal 8.x versions prior to 8.3.7 Description The views subsystem in Drupal did not restrict access to the Ajax endpoint for updating displayed data via filter parameters when creating a view. This issue can be mitigated if access restriction...
CVE-2017-6923: Missing Authorization
In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the...
Happy 16th Birthday TaoSecurity Blog
Today, 8 January 2019, is TaoSecurity Blog's 16th birthday! This is also my 3,041st blog post. I wrote my first post on 8 January 2003 while working as an incident response consultant for Foundstone. Here are a few statistics on the blog. Blogger started providing statistics in May 2010, so these...
Fedora 28 : webkit2gtk3 (2018-509fc4a5c8)
This update addresses the following vulnerability : - CVE-2018-4345 This update brings the following changes : - Many improvements and fixes for video playback with media source extensions MSE, which improve the user experience across the board, and in particular for playback of WebM videos. - Fi...
CVE-2018-19918
CuppaCMS has XSS via an SVG document uploaded to the administrator//component/tablemanager/view/cuviews URI...
PT-2019-19030
Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.3 Description The issue allows for SQL Injection via the groupSql parameter in the skins/classic/views/control.php file, as demonstrated by a newGroupMonitorIds value. This can be exploited through the API...
CVE-2018-19083: Improper Neutralization of Input During Web Page Generation
WeCenter 3.2.0 through 3.2.2 has XSS in the views/default/question/index.tpl.html htmlspecialcharsdecode function via the /?/publish/ajax/publishquestion/ questioncontent parameter...
PT-2018-14796
Name of the Vulnerable Software and Affected Versions WeCenter versions 3.2.0 through 3.2.2 Description The issue concerns a problem with the htmlspecialchars decode function in the views/default/question/index.tpl.html file. This is exploited via the "/?/publish/ajax/publish question/" API...
Drupal 8.x < 8.3.7 Multiple Vulnerabilities
According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities : - A flaw exists in the views subsystem due to a failure to restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access...
[20201107] - Core - Write ACL violation in multiple core views
Lack of input validation while handling ACL rulesets can cause write ACL violations...
Spring Security OAuth vulnerable to remote code execution (RCE) via specially crafted request using whitelabel views
When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for responsetype...
GHSA-7Q9C-H23X-65FQ Spring Security OAuth vulnerable to remote code execution (RCE) via specially crafted request using whitelabel views
When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for responsetype...
Introducing the Bot Endpoint Protection Report
Todays comprehensive monitoring capabilities in Security Center provide great insight into bot activity and countermeasures applied across your valuable web properties. Filter options allow you to focus on almost any desired detail. However, understanding what is happening on specific protected...
