PYSEC-2017-64

Cross-site scripting XSS vulnerability in the managefindResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the objids:tokens parameter...

CVE-2016-7147

CVE-2016-7147 is an XSS in the manage_findResult component of the Zope ZMI search for Plone: Plone 4.x (before 4.3.12) and Plone 5.x (before 5.0.7) are affected. The issue stems from an incomplete fix for CVE-2016-7140 and allows remote attackers to inject arbitrary script/HTML via obj_ids:tokens...

Cross-site Scripting (XSS)

plone is vulnerable to cross-site scripting XSS. It is possible to perform a reflected XSS via the ZMI managefindResult. This vulnerability exists because of an incomplete fix for CVE-2016-7140...

Plone CMS 4.3.11 / 5.0.6 XSS / Traversal / Open Redirection

Product Description Plone is a free and open source content management system built on top of the Zope application server. Plone is positioned as an "Enterprise CMS" and is most commonly used for intranets and as part of the web presence of large organizations Systems Affected Product : Plone...

CVE-2016-7140

Multiple cross-site scripting XSS vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Citrix NetScaler RCE Vulnerability (CTX200206)

Citrix NetScaler is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2014-7140

creationtimestamp| type| source ---|---|--- 2014-11-06 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/35180...

Immunity Canvas: CITRIX_NETSCALER_SOAP

Name| citrixnetscalersoap ---|--- CVE| CVE-2014-7140 Exploit Pack| CANVAS Description| Citrix Netscaler 10.1 Soap exploit Notes| FoundBy: Console Cowboys Notes: A vulnerability exists in the SOAP handler of the web interface. A SOAP request can be crafted to trigger a memory corruption flaw,...

CVE-2014-7140

CVE-2014-7140 affects Citrix NetScaler ADC/Gateway 10.x (before 10.1-129.11 and 10.5 before 10.5-50.10). The vulnerability is an unspecified remote code execution via the management interface, with a CVSSv2 base score of 7.5 (HIGH). The root cause and exact exploit vectors are not detailed in the...

CVE-2014-7140

Unspecified vulnerability in the management interface in Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway 10.x before 10.1-129.11 and 10.5 before 10.5-50.10 allows remote attackers to execute arbitrary code via unknown vectors...

Fritz!Box Webcm Unauthenticated Command Injection

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...

CVE-2013-7140

XML External Entity XXE vulnerability in the CalDAV interface in Open-Xchange OX AppSuite 7.4.1 and earlier allows remote authenticated users to read portions of arbitrary files via vectors related to the SAX builder and the WebDAV interface. NOTE: this issue has been labeled as both absolute pat...

CVE-2013-7140

Open-Xchange AppSuite 7.4.1 and earlier is affected by an XML External Entity (XXE) vulnerability in the CalDAV interface (SAX builder and WebDAV). The issue can allow remote authenticated users to read portions of arbitrary files on the server. The root cause is characterized as XXE (and may inc...

Open-Xchange Security Advisory 2014-01-17

Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 30357 Bug ID Vulnerability type: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page Vulnerable version: 7.4.1 and earlier Vulnerable component: backend Fixed version: 7.2.2-rev29, 7.4.0-rev24,...

CVE-2008-7140

Multiple cross-site scripting XSS vulnerabilities in @lex Guestbook 4.0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 languagesetup parameter to setup.php or 2 test parameter to index.php. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-7140

CVE-2008-7140 involves multiple XSS vulnerabilities in the @lex Guestbook package (version 4.0.5 and earlier). The flaws allow remote attackers to inject arbitrary web script or HTML by supplying (1) the language_setup parameter to setup.php or (2) the test parameter to index.php. The posted data...

CVE-2008-7140

creationtimestamp| type| source ---|---|--- 2008-03-31 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/31565 2008-03-31 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/31566...

Solaris 9 (sparc) : 117123-10

SunOS 5.9: wanboot and pkg utilities Patch. Date this patch was last updated by Sun : Oct/31/11 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if...

CVE-2006-7140

CVE-2006-7140 concerns the libike library used by Sun Solaris components (in.iked, elfsign, kcfd) on Solaris 9/10. When an RSA key with exponent 3 is used, libike removes PKCS#1 padding before hashing, enabling remote attackers to forge a PKCS#1 v1.5 signature signed by that RSA key and to disrup...

Mandrake Linux Security Advisory : openssl (MDKSA-2006:161)

Daniel Bleichenbacher recently described an attack on PKCS 1 v1.5 signatures where an RSA key with a small exponent used could be vulnerable to forgery of a PKCS 1 v1.5 signature signed by that key. Any software using OpenSSL to verify X.509 certificates is potentially vulnerable to this issue, a...