|
|
Colapse all |
Post message
Stored XSS Vulnerability in F5 BIG-IP Application Security Manager 2015-01-12 Peter Lapp (lappsec gmail com) Corel Software DLL Hijacking 2015-01-12 CORE Advisories Team (advisories coresecurity com) Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Corel Software DLL Hijacking 1. *Advisory Information* Title: Corel Software DLL Hijacking Advisory ID: CORE-2015-0001 Advisory URL: http://www.coresecurity.com/advisories/corel-software-dll-hijacking Date published: 2015-01-12 [ more ] [ reply ] CVE-2014-8870: Arbitrary Redirect in Tapatalk Plugin for WoltLab Burning Board 4.0 2015-01-12 RedTeam Pentesting GmbH (release redteam-pentesting de) The Tapatalk Plugin com.tapatalk.wbb4 for WoltLab Burning Board 4.0 prior to version 1.1.2 allowed to redirect users to arbitrary URLs. This was possible by specifying the target URL in the URL parameter board_url in URLs like the following: http://www.example.com/mobiquo/smartbanner/welcome.php?bo [ more ] [ reply ] [RT-SA-2014-015] Cross-site Scripting in Tapatalk Plugin for WoltLab Burning Board 4.0 2015-01-12 RedTeam Pentesting GmbH (release redteam-pentesting de) Advisory: Cross-site Scripting in Tapatalk Plugin for WoltLab Burning Board 4.0 RedTeam Pentesting discovered a cross-site scripting (XSS) vulnerability in the Tapatalk plugin for the WoltLab Burning Board forum software, which allows attackers to inject arbitrary JavaScript code via URL [ more ] [ reply ] ZTE Datacard PCW(Telecom MF180) - Multiple Software Vulnerabilities 2015-01-12 Vulnerability Lab (research vulnerability-lab com) Document Title: =============== ZTE Datacard PCW(Telecom MF180) - Multiple Vulnerabilities References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1405 Release Date: ============= 2015-01-12 Vulnerability Laboratory ID (VL-ID): ============================ [ more ] [ reply ] Heroku API Bug Bounty #1 - Persistent Invitation Vulnerability 2015-01-12 Vulnerability Lab (research vulnerability-lab com) Document Title: =============== Heroku API Bug Bounty #1 - Persistent Invitation Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1300 Video: http://www.vulnerability-lab.com/get_content.php?id=1335 BugCrowd ID: e8a8ecb81b9bf115226ed2ff0 [ more ] [ reply ] Heroku API Deep Dive Bug Bounty #3 - Persistent UI Vulnerability 2015-01-12 Vulnerability Lab (research vulnerability-lab com) Document Title: =============== Heroku API Deep Dive Bug Bounty #3 - Persistent UI Vulnerability References (Source): ==================== http://vulnerability-lab.com/get_content.php?id=1398 BugCrowd ID: 6b37910a3c5685b944a3ad65068aa251af47450953a06b8b13d74b35d708f6b0 Acknowledgement (Hall of F [ more ] [ reply ] Blitz CMS Community - SQL Injection Web Vulnerability 2015-01-12 Vulnerability Lab (research vulnerability-lab com) Document Title: =============== Blitz CMS Community - SQL Injection Web Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1403 Release Date: ============= 2015-01-12 Vulnerability Laboratory ID (VL-ID): ================================= [ more ] [ reply ] Wordpress plugin Pods <= 2.4.3 XSS and CSRF vulnerabilities 2015-01-10 Pietro Oliva (pietroliva gmail com) Vulnerability title: Wordpress plugin Pods <= 2.4.3 XSS and CSRF vulnerabilities vulnerabilities Author: Pietro Oliva CVE: CVE-2014-7956, CVE-2014-7957 Product: pods Affected version: pods <= 2.4.3 Vulnerabilities fixed in version: 2.5 XSS vulnerability (CVE-2014-7956, authentication is needed): h [ more ] [ reply ] [security bulletin] HPSBOV03227 rev.1 - HP SSL for OpenVMS, Remote Disclosure of Information, Denial of Service (DoS) and Other Vulnerabilities 2015-01-10 security-alert hp com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04533567 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04533567 Version: 1 HPSBOV03227 re [ more ] [ reply ] Re: ResourceSpace Multiple Cross Site Scripting, and HTML and SQL Injection Vulnerabilities 2015-01-09 dan montala com Hi, I'm from Montala - we head up ResourceSpace development. Just to add an update - we believe all issues have been fixed in the ResourceSpace Subversion repository. In fact the majority were fixed some time ago however the original submitter was checking against an older version. We aim to rele [ more ] [ reply ] |
|
Privacy Statement |
=======
Product: F5 BIG-IP Application Security Manager (ASM)
Vulnerability: Cross Site Scripting
Author: Peter Lapp, lappsec (at) gmail (dot) com [email concealed]
CVE: None assigned
Vulnerable Versions: Confirmed 11.4.0, 11.4.1. Likely 11.4.x-11.5.x.
Fixed Version: 11.6
Summary
=======
The F5 ASM is a web applica
[ more ] [ reply ]