| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <-YgADj6FQeXpzrcnIqoBu0mwR6xCh8oIay4EyYBMTsWH0FquEWnce2X-FWVE4P1zDm6WEZlbHO63S_ImG3uD1ZM-__Edc-WrYqA-WVOxNow=@protonmail.com> Date: Tue, 12 Nov 2019 16:42:30 +0000 From: infinitybuzz via Fulldisclosure <fulldisclosure@...lists.org> To: fulldisclosure <fulldisclosure@...lists.org> Subject: [FD] Centraleyezer: Unrestricted File Upload — [CVE-2019–12311] Centraleyezer: Unrestricted File Upload — [CVE-2019–12311] Sandline Centraleyezer (On Premises) allows Unrestricted File Upload leading to Stored XSS. An HTML page running a script could be uploaded to the server. When a victim tries to download a CISO Report template, the script is loaded. The attacker could upload a html page that runs a script, when the victim tries to download the template, it loads the html page with the script. More Information: https://link.medium.com/l0B0yMxMy1 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists