Concrete CMS: Stored XSS vulnerability in additional URLs in 'Location' dialog [Sitemap]

Intro "Transformers: Dark of the Crayons" Type of issue: Core CMS issue Level of severity: Internal Attack Vector Concrete5 version: 8.2.0 RC2 rev. 0a26b63c4a64d42e7afb36aba0a6e4d1f4c53d7d July 19th Summary There is Stored XSS vulnerability in additional URLs in 'Location' dialog. This issue can ...

Concrete CMS: SSRF thru File Replace

Hello Team, Version: 8.2.0 Details: I have found a possibility of Server Side Request Forgery via file 'Replace' functionality. An attacker / malicious user is able to scan local network and able to enumerate open TCP ports. The root of cause of this vulnerability: - you are allowing to use...

CVE-2017-6652

A vulnerability in the web framework of the Cisco TelePresence IX5000 Series could allow an unauthenticated, remote attacker to access arbitrary files on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using directory...

Directory traversal

A vulnerability in the web framework of the Cisco TelePresence IX5000 Series could allow an unauthenticated, remote attacker to access arbitrary files on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using directory...

BSA-2017-247

Security Advisory ID : BSA-2017-247 Component : OpenSSH Revision : 3.0: Final Theauthpasswordfunction inauth-passwd.cinsshdinOpenSSHbefore 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service crypt CPU consumption via a long...

Authentication Bypass in TYPO3 Frontend

It has been discovered, that TYPO3 CMS is vulnerable to Authentication Bypass. Component Type: TYPO3 CMS Release Date: February 28, 2017 Vulnerable subcomponent: Frontend Vulnerability Type: Authentication Bypass Affected Versions: Versions 8.2.0 to 8.6.0 Severity: Medium Suggested CVSS v2.0:...

Insecure Unserialize in TYPO3 Import/Export

It has been discovered, that TYPO3 is susceptible to Insecure Unserialize. Component Type: TYPO3 CMS Release Date: July 19, 2016 Vulnerable subcomponent: Import/Export Vulnerability Type: Insecure Unserialize Affected Versions: Versions 6.2.0 to 6.2.25, 7.6.0 to 7.6.9 and 8.0.0 to 8.2.0 Severity:...

CVE-2014-5276

Multiple cross-site scripting XSS vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to inject arbitrary web script or HTML via 1 an uploaded profile picture or 2 the edit parameter to profiles/index.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to inject arbitrary web script or HTML via 1 an uploaded profile picture or 2 the edit parameter to profiles/index.php...

Pro Chat Rooms 8.2.0 - Multiple Vulnerabilities

Pro Chat Rooms 8.2.0 - Multiple Vulnerabilities Exploit Title: Pro Chat Rooms v8.2.0 - Multiple Vulnerabilities Google Dork: intitle:"Powered by Pro Chat Rooms" Date: 5 August 2014 Exploit Author: Mike Manzotti @ Dionach Ltd Vendor Homepage: http://prochatrooms.com Software Link:...

Code injection

Unspecified vulnerability in the Integrated Lights Out Manager CLI in Oracle Sun Products Suite SysFW 8.2.0.a for SPARC and Netra SPARC T3 and T4-based servers, and other versions and servers, allows local users to affect confidentiality via unknown vectors...

CVE-2012-3206

Unspecified vulnerability in the Integrated Lights Out Manager CLI in Oracle Sun Products Suite SysFW 8.2.0.a for SPARC and Netra SPARC T3 and T4-based servers, and other versions and servers, allows local users to affect confidentiality via unknown vectors...

DVbbs Version 8.2.0 dispbbs.asp 跨站漏洞

北洋贱队http://bbs.seceye.org首发 demo: http://bbs.chinadz.com/dispbbs.asp?boardid=17&id=530722&page=%22%3E%3Ciframe%20src=http://www.gohack.org%3E 不解释，爱好分析代码的朋友请撰文投稿黑客手册。 DVbbs Version 8.2.0 等待官方更新补丁...

Moving network Forum(DVBBS)Show. asp page the filter is not strict lead to cross-site vulnerability-vulnerability warning-the black bar safety net

Add time: 2009-05-25 System number: WAVDB-0 1 4 3 2 Affected version: DVBBS 8.0.0-8.2.0 Program description: Moving web forums as a dynamic network the main services of one of the products, from 2 0 0 1 year investment promotion and operated since, has been at home and abroad the majority of...

Sql injection

SQL injection vulnerability in login.asp in Dvbbs 8.2.0 allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2008-5222

SQL injection vulnerability in login.asp in Dvbbs 8.2.0 allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2008-5222

SQL injection vulnerability in login.asp in Dvbbs 8.2.0 allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2008-5222

CVE-2008-5222 is a SQL injection vulnerability in login.asp of Dvbbs 8.2.0, exploitable via the username parameter to execute arbitrary SQL remotely. The NVD entry shows a CVSSv2 base score of 7.5 (HIGH), with network access, no authentication, and partial impacts on confidentiality, integrity, a...

LibSPF2 < 1.2.8 DNS TXT Record Parsing Bug Heap Overflow PoC

Exploit for multiple platform in category dos / poc ============================================================ LibSPF2 1.2.8 DNS TXT Record Parsing Bug Heap Overflow PoC ============================================================ Advisory: DNS TXT Record Parsing Bug in LibSPF2 Author: Dan...

ISC BIND 8 - Remote Cache Poisoning (2)

source: https://www.securityfocus.com/bid/25459/info BIND 8 is prone to a remote cache-poisoning vulnerability because of weaknesses in its random-number generator. An attacker may leverage this issue to manipulate cache data, potentially facilitating man-in-the-middle, site-impersonation, or...