Cross site scripting

DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedbackajax.php...

CVE-2018-16784

DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...

CVE-2018-16784

DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...

USN-3725-1: MySQL vulnerabilities

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 5.5.61 in Ubuntu 14.04 LTS. Ubuntu 16.04 LTS and Ubuntu 18.04 LTS have been updated to MySQL 5.7.23. In addition to security fixes, the updated...

CVE-2016-8647

An input validation vulnerability was found in Ansible's mysqluser module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed...

MySQL 5.7.x < 5.7.23 Multiple Vulnerabilities (RPM Check) (July 2018 CPU)

The version of MySQL running on the remote host is 5.7.x prior to 5.7.23. It is, therefore, affected by multiple vulnerabilities as noted in the July 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information. Note that Nessus has not...

TOPdesk Cross-Site Scripting Vulnerability

TOPdesk is a terminal management system from the Dutch company TOPdesk. The system enables the management and maintenance of desktop systems through behavioral monitoring, system monitoring and security status detection. A cross-site scripting vulnerability exists in TOPdesk versions prior to...

CVE-2018-10231

Cross-site scripting XSS vulnerability in TOPdesk before 8.05.017 June 2018 version and before 5.7.SR9 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2018-10232

CVE-2018-10232 is a CSRF vulnerability in TOPdesk prior to 8.05.017 (June 2018) and prior to 5.7.SR9. The flaw allows remote attackers to hijack the authentication of logged-in users to perform requests that can reveal sensitive information via unspecified vectors. Public sources identify the aff...

Ubuntu: Security Advisory (USN-3629-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-3629-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2018-3060 · Oracle +5 · Mysql Server +4

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 5.6.39 and prior MySQL Server versions 5.7.21 and prior Description: The issue is related to the InnoDB component of Oracle MySQL Server and is caused by inadequate access control. It allows a low-privileged attacker wit...

CVE-2018-9175

DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselectmain.php because code within the database is accessible to uploads/dede/syscacheup.php...

CVE-2018-9175

DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselectmain.php because code within the database is accessible to uploads/dede/syscacheup.php...

Code injection

DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselectmain.php because code within the database is accessible to uploads/dede/syscacheup.php...

CVE-2018-9175

DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselectmain.php because code within the database is accessible to uploads/dede/syscacheup.php...

CVE-2018-9174

sysverifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, because the contents of modifytmp.inc are under an attacker's control...

CVE-2018-9175

DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselectmain.php because code within the database is accessible to uploads/dede/syscacheup.php...

CVE-2018-9174

sysverifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, because the contents of modifytmp.inc are under an attacker's control...

CVE-2018-9175

DedeCMS 5.7 contains a remote code execution vulnerability (CVE-2018-9175) via the egroup parameter to uploads/dede/stepselect_main.php. The attack leverages that code written into the database can be exposed to uploads/dede/sys_cache_up.php, enabling an attacker to inject PHP through database-ba...