363 matches found
pbskids.org XSS vulnerability
Open Bug Bounty ID: OBB-563897 Description| Value ---|--- Affected Website:| pbskids.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Debian DLA-1191-1 : python-werkzeug security update
A security issue that allows XSS on the Werkzeug debugger allows remote attackers to inject arbitrary stuff via a field that contains an exception message. For Debian 7 'Wheezy', these problems have been fixed in version 0.8.3+dfsg-1+deb7u1. We recommend that you upgrade your python-werkzeug...
CVE-2017-7059
A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component...
CVE-2017-1000006
Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue...
CVE-2017-7665
In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient...
EZSA-2017-005 XSS issue in search
More info at http://share.ez.no/community-project/security-advisories/ezsa-2017-005-xss-issue-in-search...
Emby MediaServer 3.2.5 Reflected Cross Site Scripting
Emby MediaServer 3.2.5 Reflected XSS Vulnerability Vendor: Emby LLC Product web page: https://www.emby.media Affected version: 3.2.5 3.1.5 3.1.2 3.1.1 3.1.0 3.0.0 Summary: Emby formerly Media Browser is a media server designed to organize, play, and stream audio and video to a variety of devices...
CVE-2016-9856
An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are...
Race condition
An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are...
CVE-2016-9856
An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are...
openSUSE Security Update : roundcubemail (openSUSE-2016-995)
This update for roundcubemail fixes the following vulnerabilities : - CVE-2015-8864: XSS issue in SVG images handling boo976988 - CVE-2015-2181: issue in DBMail driver of password plugin - CVE-2016-4069: Cross-site request forgery in download URLs boo976988 Roundcubemail was also updated to 1.1.5...
Fedora 24 : roundcubemail-1.1.5-1.fc24 (2016-aff691237e)
Release 1.1.5 Plugin API: Added html2text hook Plugin API: Added addressbookexport hook Fix missing emoticons on html-to-text conversion Fix random 'access to this resource is secured against CSRF' message at logout 4956 Fix missing language name in 'Add to Dictionary' request in HTML mode 4951...
Fedora 22 : roundcubemail-1.1.5-1.fc22 (2016-a9c8f9dcff)
Release 1.1.5 Plugin API: Added html2text hook Plugin API: Added addressbookexport hook Fix missing emoticons on html-to-text conversion Fix random 'access to this resource is secured against CSRF' message at logout 4956 Fix missing language name in 'Add to Dictionary' request in HTML mode 4951...
MGASA-2016-0155 Updated roundcubemail packages fix security vulnerabilities
Updated roundcubemail packages fix security vulnerabilities: More security issues in the DBMail driver for the password plugin, related to CVE-2015-2181. XSS issue in SVG images handling CVE-2015-8864. Lack of protection for attachment download URLs against CSRF CVE-2016-4069. The roundcubemail...
Algolia: an xss issue
i found an xss issue here : https://www.algolia.com/explorer?index=test&tab=ranking i tried to put an xss payload " in index ranking so i put the xss payload in Ranking formula then hit save ...when it is being saved the xss payload is being stored that upon Indices xss payload executed p.s pleas...
MGASA-2015-0340 Updated jsoup package fixes security vulnerability
Jsoup before 1.8.3 was vulnerable to a possible XSS issue in the validator, related to how it handled tags without a closing '' when reaching EOF CVE-2015-6748...
WordPress Sites Backdoored, Leaking Credentials
WordPress site administrators just cannot come up for air. With a raft of WordPress vulnerabilities—most of them in plugins—to address, now comes word that a number of sites running the content management system have been compromised and are sending credentials via a backdoor to a criminal group...
Incorrect handling of self signed certificates in OpenFire XMPP Server
Incorrect handling of self signed certificates in OpenFire XMPP Server Affected software: OpenFire XMPP server Affected versions: 3.9.3 and earlier Vulnerabilities addressed: CVE-2014-3451, CVE-2015-2080 Openfire is a real time collaboration RTC server licensed under the Open Source Apache Licens...
DLA-115-1 gosa - security update
Bulletin has no description...
cacti -- multiple security vulnerabilities
The Cacti Group, Inc. reports: Important Security Fixes CVE-2013-5588 - XSS issue via installer or device editing CVE-2013-5589 - SQL injection vulnerability in device editing CVE-2014-2326 - XSS issue via CDEF editing CVE-2014-2327 - Cross-site request forgery CSRF vulnerability CVE-2014-2328 -...