LFCMS 3.7.0 - Cross-Site Request Forgery (Add Admin)

Exploit Title: A CSRF vulnerability exists in LFCMS3.7.0: administrator account can be added arbitrarily. Date: 2018-06-20 Exploit Author: bay0net Vendor Homepage: https://www.cnblogs.com/v1vvwv/p/9203899.html Software Link: http://www.lfdycms.com/home/down/index/id/26.html Version: 3.7.0 CVE :...

LFCMS 3.7.0 - Cross-Site Request Forgery (Add User)

Exploit Title: A CSRF vulnerability exists in LFCMS3.7.0: users can be added arbitrarily. Date: 2018-06-20 Exploit Author: bay0net Vendor Homepage: https://www.cnblogs.com/v1vvwv/p/9203740.html Software Link: http://www.lfdycms.com/home/down/index/id/26.html Version: 3.7.0 CVE : CVE-2018-12602 A...

PSF-2018-4 difflib and poplib catastrophic backtracking

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.ISLINEJUNK method. An attacker could use this flaw to cause denial of service...

Joomla! 3.7.0 < 3.7.1 fields.php getListQuery() Method SQLi

The Joomla! installation running on the remote web server is affected by a SQL injection vulnerability in the fields.php script due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database,...

Joomla 'com_fields' RCE Vulnerability (20180506)

Joomla is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla";...

2345 Security Guard Security Bypass Vulnerability

2345 Security Guard is a set of computer security protection software from China's 2345 Corporation. A security vulnerability exists in the 2345MPCSafe.exe, 2345SafeTray.exe, and 2345Speedup.exe files in 2345 Security Guard version 3.7.0. A local attacker can exploit this vulnerability to bypass...

CVE-2018-1000117

Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python script that creates...

CVE-2018-1000117

Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python script that creates...

Joomla 3.7.0 <= 3.8.3 Multiple Vulnerabilities

Joomla is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla"; ifdescription...

Octopus Deploy XSS Vulnerability

Cross-site scripting XSS vulnerability in Octopus Deploy allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright ...

Octopus Deploy Cross-Site Scripting Vulnerability

Octopus Deploy is an automation tool from Octopus Deploy Australia for development and deployment of . A cross-site scripting vulnerability exists in Octopus Deploy versions 3.7.0 through 3.17.13. The vulnerability can be exploited by a remote attacker to inject arbitrary web script or HTML using...

CVE-2017-16801

Cross-site scripting XSS vulnerability in Octopus Deploy 3.7.0-3.17.13 fixed in 3.17.14 allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter...

CVE-2017-16801

Cross-site scripting XSS vulnerability in Octopus Deploy 3.7.0-3.17.13 fixed in 3.17.14 allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter...

Joomla! Core 'com_fields' Information Disclosure Vulnerability (Nov 2017)

Joomla is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla";...

CVE-2017-2255

Cross-site scripting vulnerability in Cybozu Garoon 3.7.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text" function of the application "Space"...

Joomla! 3.7 Core SQL injection (CVE-2017-8917)vulnerability analysis-vulnerability warning-the black bar safety net

Author: p0wd3r know Chong Yu 404 security lab Date: 2017-05-18 0x00 vulnerability overview Vulnerability description Joomla to 5 on 17 May released the new version 3. 7. 1, of this update fixes a high-riskSQL injectionvulnerability to successfully exploit the vulnerability an attacker can...

Joomla! Information Disclosure and XSS Vulnerabilities

Joomla is prone to information disclosure and cross-site scripting vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2017-8057

In Joomla! 3.4.0 through 3.6.5 fixed in 3.7.0, multiple files caused full path disclosures on systems with enabled error reporting...

CVE-2017-7983

In Joomla! 1.5.0 through 3.6.5 fixed in 3.7.0, mail sent using the JMail API leaked the used PHPMailer version in the mail headers...

dotCMS cross-site scripting vulnerability (CNVD-2017-04649)

dotCMS is a content management system CMS from the United States dotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A cross-site scripting vulnerability exists in dotCMS version 3.7.0. A remote attacker can exploit this...