Stored Cross-Site Scripting (XSS)

Apache Ranger is vulnerable to stored cross-site scripting XSS attacks. When entering custom policy conditions, admin users can store some arbitrary javascript code to be executed when normal users login and access policies...

UBUNTU-CVE-2017-6446

XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters...

CVE-2017-3795

A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to conduct arbitrary password changes against any non-administrative user. More Information: CSCuz03345. Known Affected Releases: 2.6. Known Fixed Releases: 2.7.1.12...

CVE-2017-3794

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against an administrative user. More Information: CSCuz03317. Known Affected Releases: 2.6. Known Fixed Releases: 2.7.1.12...

How to set the keyboard to automatically pop up while opening the app with Receiver for iPad

This article is intended for Citrix administrators and technical teams only.Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information Users need to be able to access the keyboard in Receiver. We would like this function to come up...

PT-2017-8533

Name of the Vulnerable Software and Affected Versions Web2py versions 2.14.5 and below Description The issue allows an attacker to perform a Reflected XSS attack on a logged-in user, specifically those with admin privileges. Recommendations For Web2py versions 2.14.5 and below, at the moment, the...

Foreman 1.10.x < 1.11.4, 1.12.0 Information Disclosure Vulnerability

Foreman is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:theforeman:foreman";...

baserCMS plugin Mail vulnerable to cross-site request forgery

Overview baserCMS provided by baserCMS User Group is an opensource content management system. baserCMS and bundled plugin Mail contain a cross-site request forgery vulnerability. Isao Takaesu of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with t...

Error: "AddOrRemoveSSONProvOrder: Could Not Open Key for Access" While Installing Receiver 14.4.1

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. "AddOrRemoveSSONProvOrder: Could not open key for access."...

Win10 - Receiver4.3: Runtime Error for Wfica32.exe when launching app

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Runtime Error for Wfica32.exe when launching app...

Vulnerability of Microsoft Office software, which allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information

A vulnerability that allows for remote execution of code exists in Microsoft Office and is related to the processing of certain properties of Microsoft Word files. If a user with administrative privileges accesses the system, a malicious individual can gain full control over the system. They can...

Apache CouchDB Arbitrary Command Execution

CouchDB administrative users can configure the database server via HTTPS. Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitra...

Dating Pro Genie 2015.7 Cross Site Request Forgery

Advisory ID: HTB23294 Product: Dating Pro Vendor: DatingPro Vulnerable Versions: Genie 2015.7 and probably prior Tested Version: Genie 2015.7 Advisory Publication: February 10, 2016 without technical details Vendor Notification: February 10, 2016 Vendor Patch: February 29, 2016 Public Disclosure:...

Comodo Anti-Virus - SHFolder.dll Local Privilege Elevation Exploit

Exploit for windows platform in category local exploits SHFolder.DLL Local Privilege Elevation Exploit for Comodo Anti-Virus GeekBuddy Component by @LaughingMantis Greg Linares Since it took 146 days to fix a DLL Hijack issue I decided to drop this PoC: Technical Geeky Stuff GeekBuddy stores...

SeaWell Networks Spectrum - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: SeaWell Networks Spectrum - Multiple Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: http://www.seawellnetworks.com/spectrum/ Versions Reported: Spectrum SDC 02.05.00, Build 02.05.00.0016 CVE-ID: CVE-2015-8282...

LG Nortel Disclosure / Insecure Configuration / DoS

Title: LG Nortel ADSL modems - Multiple vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: NA Version Reported: Board ID: DV2020+Product Version: S1.064B2.3H0-0 + Software Version: 3.04L.02V.sip.LE9500.dspApp3341A2pB022f.d19e Timelines April, 2015: Vulnerabilities found April 2015:...

SearchBlox File Exfiltration Denial of Service Vulnerability

SearchBlox is a set of open source and free based on Lucene full-text search engine toolkit to build enterprise search and analytics solutions. A security vulnerability exists in SearchBlox that allows remote attackers to exploit the vulnerability to overwrite configuration files, add or remove...

Duplicate App Icons on Receiver for Windows

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Affected users see multiple stores configured CCA4-UK, CCA4-UK1, CCA4-UK2 and so on. Receiver was...

WordPress wp-championship plugin SQL injection vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL. wp-championship is one of the plugins used to play guessing games. A SQL injection vulnerability exists in the...

Kerio Control 8.6.1 - Multiple Vulnerabilities

Exploit for php platform in category web applications Title: Multiple Vulnerabilities in Kerio Control Virtual Appliance Vulnerabilities: SQL Injection, Remote Code Execution through CSRF Product: Kerio Control Homepage: http://www.kerio.com Affected Version: = 8.6.1 Fixed Version: 8.6.2 partiall...