BlackCat CMS Cross-Site Scripting Vulnerability

BlackCat CMS is a content management system CMS based on PHP5 and HTML5 developed by Black Cat team. A cross-site scripting vulnerability in BlackCat CMS 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the name of a new group in backend/group/indexphp...

Juniper Junos BGP-VPLS Handling Denial of Service Vulnerability

Juniper Networks JUNOS is an operating system that runs on Juniper Networks' line of border routers and more. A security vulnerability in Juniper Junos allows a remote attacker to send a large number of BGP-VPLS notices containing updated BGP local reference values, crashing the target RPD backen...

Sql injection

The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service session store consumption via multiple requests with unique session keys...

CVE-2015-5521

Cross-site scripting XSS vulnerability in BlackCat CMS 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the name in a new group to backend/groups/index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in BlackCat CMS 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the name in a new group to backend/groups/index.php...

PT-2015-6970 · Blackcat · Blackcat Cms

Name of the Vulnerable Software and Affected Versions: BlackCat CMS version 1.1.2 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the name in a new group to "backend/groups/index.php" API endpoint. This enables attackers to perform cross-site scripting XS...

TYPO3 CMS Backend Subcomponent Information Disclosure Vulnerability

TYPO3 is a free and open source content management system. A security vulnerability exists in the TYPO3 CMS Backend subcomponent that allows remote attackers to exploit the vulnerability to submit special requests and obtain sensitive information...

ISC BIND 'isselfsigned()' Denial of Service Vulnerability

BIND is a very widely used implementation of the DNS protocol. ISC BIND name.c is configured as a DNSSEC-verifiable recursive resolver, allowing remote attackers to construct domain data, query the domain name, and submit special requests that can crash the backend program...

[SECURITY] Fedora 21 Update: cups-x2go-3.0.1.3-1.fc21

X2Go is a server based computing environment with - session resuming - low bandwidth support - session brokerage support - client side mass storage mounting support - audio support - authentication by smartcard and USB stick CUPS backend for printing from X2Go...

EMC Multiple Products Arbitrary File Upload Vulnerability

EMC Documentum is an enterprise document and image management tool that makes the creation, modification, tracking and utilization of documents in business processes efficient, standardized and rigorous Arbitrary file upload vulnerabilities exist in various EMC products, which can be exploited by...

Brute Force Protection Bypass in backend login

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-006/...

Cross-Site Scripting exploitable by Editors

It has been discovered, that TYPO3 is susceptible to Cross-Site Scripting Component Type: TYPO3 CMS Release Date: July 1, 2015 Vulnerable subcomponent: Backend Vulnerability Type: Cross-Site Scripting Affected Versions: Versions 6.2.0 to 6.2.13, 7.0.0 to 7.3.0 Severity: Low Suggested CVSS v2.0:...

Brute Force Protection Bypass in backend login

It has been discovered, that the backend login brute force protection can be bypassed Component Type: TYPO3 CMS Release Date: July 1, 2015 Vulnerable subcomponent: Backend Vulnerability Type: Brute Force Protection Bypass Affected Versions: Versions 6.2.0 to 6.2.13, 7.0.0 to 7.3.0 Severity: Low...

Information Disclosure possibility exploitable by Editors

It has been discovered, that editors could list all files and folders in the root directory of a TYPO3 installation. Component Type: TYPO3 CMS Release Date: July 1, 2015 Vulnerable subcomponent: Backend Vulnerability Type: Information Disclosure Affected Versions: Versions 6.2.0 to 6.2.13, 7.0.0 ...

postgresql: double-free after authentication timeout

A double-free flaw was found in the way PostgreSQL handled connections. An unauthenticated attacker could possibly exploit this flaw to crash the PostgreSQL backend by disconnecting at approximately the same time as the authentication time out was triggered...

postgresql: double-free after authentication timeout

A double-free flaw was found in the way PostgreSQL handled connections. An unauthenticated attacker could possibly exploit this flaw to crash the PostgreSQL backend by disconnecting at approximately the same time as the authentication time out was triggered...

postgresql: double-free after authentication timeout

A double-free flaw was found in the way PostgreSQL handled connections. An unauthenticated attacker could possibly exploit this flaw to crash the PostgreSQL backend by disconnecting at approximately the same time as the authentication time out was triggered...

Fedora 22 : curl-7.40.0-5.fc22 (2015-10155)

implement public key pinning for NSS backend 1195771 - fix lingering HTTP credentials in connection re-use CVE-2015-3236 - prevent SMB from sending off unrelated memory contents CVE-2015-3237 - curl-config --libs now works on x8664 without libcurl-devel.x8664 1228363 Note that Tenable Network...

[RT-SA-2015-002] SQL Injection in TYPO3 Extension Akronymmanager

Advisory: SQL Injection in TYPO3 Extension Akronymmanager An SQL injection vulnerability in the TYPO3 extension "Akronymmanager" allows authenticated attackers to inject SQL statements and thereby read data from the TYPO3 database. Details ======= Product: sbakronymmanager Affected Versions: =0.5...

TYPO3 Extension Akronymmanager 0.5.0 - SQL Injection

TYPO3 Extension Akronymmanager 0.5.0 - SQL Injection Advisory: SQL Injection in TYPO3 Extension Akronymmanager An SQL injection vulnerability in the TYPO3 extension "Akronymmanager" allows authenticated attackers to inject SQL statements and thereby read data from the TYPO3 database. Details...