CVE-2018-7063: Improper Restriction of XML External Entity Reference

In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete...

CVE-2018-19544

JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...

Cross site request forgery (csrf)

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...

CVE-2018-19544: Cross-Site Request Forgery (CSRF)

JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...

PT-2018-14990

Name of the Vulnerable Software and Affected Versions JEECMS version 9.3 Description The issue allows for CSRF via the "api/admin/role/save" API endpoint to add a user. Recommendations For JEECMS version 9.3, consider implementing proper CSRF protection mechanisms to prevent unauthorized actions...

PT-2018-14989

Name of the Vulnerable Software and Affected Versions JEECMS version 9.3 Description The issue allows for CSRF via the "api/admin/content/save" API endpoint to add news. Recommendations For JEECMS version 9.3, as a temporary workaround, consider restricting access to the "api/admin/content/save"...

CVE-2018-19545: Cross-Site Request Forgery (CSRF)

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...

SQL Injection Vulnerability in MIPCMS ApiAdminTag.php Page

MIPCMS is a free and open source based on Baidu Mobile Accelerator MIP engine based on the development of articles, information, content management system, but also the system for the Internet webmasters, entrepreneurs and other groups to create SEO-optimized after the station-building system. A...