1936 matches found
Cisco Webex Teams Web Interface Cross-Site Scripting Vulnerability
A vulnerability in the web-based interface of Cisco Webex Teams could allow an authenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper validation of usernames. An attacker could exploit this vulnerability by creating an account that contains...
PT-2020-4647 · Cisco · Cisco Webex Teams
Name of the Vulnerable Software and Affected Versions: Cisco Webex Teams affected versions not specified Description: A vulnerability in the web-based interface of Cisco Webex Teams could allow an authenticated, remote attacker to conduct cross-site scripting attacks. The issue is due to improper...
RHEL 7 : Satellite 6.8 (Important) (RHSA-2020:4366)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4366 advisory. Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring...
EulerOS 2.0 SP5 : mailman (EulerOS-SA-2020-2256)
According to the versions of the mailman package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.CVE-2020-12108 - GNU Mailman 2.x before 2.1.30 uses the .obj...
CVE-2020-3582 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the web services interface of an...
Huawei EulerOS: Security Advisory for python-lxml (EulerOS-SA-2020-2236)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for python-lxml (EulerOS-SA-2020-2235)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2020-3580
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the web services interface of an...
EulerOS 2.0 SP9 : python-lxml (EulerOS-SA-2020-2236)
According to the version of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use...
XSS through image upload on contacts using svg file with png extension (NC-SA-2020-044)
A missing file type check in Nextcloud Contacts 3.4.0 allowed a malicious user to upload SVG files as PNG files to perform XSS attacks...
CVE-2020-24408
Magento versions 2.4.0 and 2.3.5p1 and earlier are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This...
Debian DLA-2403-1 : rails security update
A potential Cross-Site Scripting XSS vulnerability was found in rails, a ruby based MVC framework. Views that allow the user to control the default not found value of the t and translate helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing...
Security Bulletin: IBM Security Guardium Insights is affected by a Netty vulnerability
Summary IBM Security Guardium Insights has addressed the following vulnerability Vulnerability Details CVEID: CVE-2020-7238 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by a flaw when handling Transfer-Encoding whitespace and a later Content-Length header. By sending a...
Security Bulletin: IBM Cloud Private is vulnerable to a Netty vulnerability (CVE-2020-7238)
Summary IBM Cloud Private is vulnerable to a Netty vulnerability Vulnerability Details CVEID: CVE-2020-7238 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by a flaw when handling Transfer-Encoding whitespace and a later Content-Length header. By sending a specially-crafted...
Ubuntu 20.04 LTS : Sanitize vulnerability (USN-4543-1)
The remote Ubuntu 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4543-1 advisory. Micha Bentkowski discovered that Sanitize did not properly sanitize some math or svg HTML under certain circumstances. A remote attacker could potentially exploit...
Cross-site Scripting (XSS)
gon is vulnerable to cross-site scripting XSS attacks. Lack of sanitization of malicious characters within the JSON data in jsondumper.rb allows a malicious user to inject and execute arbitrary javascript in a user's browser...
Ubuntu: Security Advisory (USN-4498-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Magecart’s Success Paves Way For Cybercriminal Credit Card 'Sniffer' Market
The Magecart threat group has dominated headlines for its use of malicious JavaScript code, which is injected into e-commerce websites to exfiltrate customer payment card data. But new research points to a growing industry on underground forums where so-called “sniffers” are being advertised, sol...
Joomla 2.5.x < 3.9.21 Multiple Vulnerabilities (5821-joomla-3-9-21)
According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.21. It is, therefore, affected by multiple vulnerabilities. - Lack of escaping in modlatestactions allows XSS attacks. CVE-2020-24599 - Lack of input validation in comcontent lea...
