CVE-2017-12136

CVE-2017-12136 affects Xen 4.6.x–4.9.x. The issue is a race condition in grant table maptrack free list handling, enabling a malicious guest administrator to crash the host or escalate privileges to the host. Public advisories (GLSA 201801-14; SUSE SU-2017:2327-2) document the fix as Xen upgrades...

Cross site scripting

Cross-site scripting XSS vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name...

CVE-2017-12844

Cross-site scripting XSS vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name...

Sql injection

The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwgedittag in photo-gallery.php and edittag in admin/controllers/BWGControllerTagsbwg.php. It is exploitable by administrators via the tagid parameter...

CVE-2017-12977

The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwgedittag in photo-gallery.php and edittag in admin/controllers/BWGControllerTagsbwg.php. It is exploitable by administrators via the tagid parameter...

CVE-2017-12977

The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwgedittag in photo-gallery.php and edittag in admin/controllers/BWGControllerTagsbwg.php. It is exploitable by administrators via the tagid parameter...

CVE-2017-12946

classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators...

CVE-2017-12946

classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators...

CVE-2017-12947

classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators...

Enabling Save Passwords option with Receiver for ios and Storefront

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company's Help Desk/IT support team and can refer to CTX297149 for more information. For Storefront Direct Connections , password saving is not available for receiver for ios and end...

Kanboard Password Reset Vulnerability

Kanboard is a French software developer Frederic Guillot developed a set of open source visualization task board software. The software supports customization of the panel according to the business, task dragging and so on. A security vulnerability exists in Kanboard versions prior to 1.0.46. The...

CMS Made Simple <= 2.2.2 Upload Vulnerability

CMS Made Simple is prone to an upload vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cmsmadesimple:cmsmadesimple"...

[SECURITY] Fedora 25 Update: remmina-1.2.0-0.39.20170724git0387ee0.fc25

Remmina is a remote desktop client written in GTK+, aiming to be useful for system administrators and travelers, who need to work with lots of remote computers in front of either large monitors or tiny net-books. Remmina supports multiple network protocols in an integrated and consistent user...

Receiver for Windows 4.8, error "The specified module could not be found."

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Unable to launch Published Desktops, it fails to launch with error"The specified module could not be...

Google Releases Security Updates for Chrome OS

Google has released Chrome OS version 60.0.3112.80 for Chrome devices to address multiple vulnerabilities. Exploitation of one these vulnerabilities could allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review the Google Chrome blog entry...

[SECURITY] Fedora 26 Update: remmina-1.2.0-0.39.20170724git0387ee0.fc26

Remmina is a remote desktop client written in GTK+, aiming to be useful for system administrators and travelers, who need to work with lots of remote computers in front of either large monitors or tiny net-books. Remmina supports multiple network protocols in an integrated and consistent user...

CVE-2017-11183

front/backup.php in GLPI before 9.1.5 allows remote authenticated administrators to delete arbitrary files via a crafted file parameter...

CVE-2017-11183

GLPI prior to 9.1.5 is affected by CVE-2017-11183: remote authenticated administrators can delete arbitrary files through a crafted file parameter in front/backup.php. Root cause: improper handling of the file parameter leading to arbitrary file deletion. Mitigation: upgrade GLPI to a fixed relea...

Can Users Still See Disabled Applications on StoreFront or Receiver Self Service Console if Using a Site Created on StoreFront

This article is intended for Citrix administrators and technical teams only.Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information Question: If Users are connecting to a StoreFront created site and accessing applications from a XA 6.x ...

CVE-2017-2273

Cross-site request forgery CSRF vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...