PT-2017-16821

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.0.5.10 Description The issue allows an attacker to perform a CSRF attack on the "admin/blog/add/" endpoint, enabling them to add any blog entry. Additionally, the attacker can insert XSS into the blog entry via the body...

CVE-2017-6069: Cross-Site Request Forgery (CSRF)

Subrion CMS 4.0.5 has CSRF in admin/blog/add/. The attacker can add any tag, and can optionally insert XSS via the tags parameter...

PT-2017-16877

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.0.5 Description The issue allows an attacker to perform a CSRF attack on the "admin/blog/add/" endpoint, enabling them to add any tag. Additionally, the attacker can optionally insert XSS via the tags parameter...

CVE-2017-6002: Cross-Site Request Forgery (CSRF)

Subrion CMS 4.0.5.10 has CSRF in admin/blog/add/. The attacker can add any blog entry, and can optionally insert XSS into that entry via the body parameter...

Logsign 4.4.2/4.4.137 - Remote Command Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Logsign Remote Command Injection', 'Description' = %q This module exploits an command injection vulnerability in Logsign. By exploiting this...

LastPass Password Manager and then exposed a serious vulnerability, the browser-based Password Manager can also be used? - Vulnerability warning-the black bar safety net

No use cryptographic software before, we easily forget the password; use password software, we“reluctantly”leak the All password. LastPass, the popular password management software, recently again broke security vulnerabilities. Security personnel found in LastPass Chrome and Firefox 4.1.42 versi...

Logsign Remote Command Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Logsign Remote Command Injection', 'Description' = %q This module exploits an command injection vulnerability in Logsign. By exploiting this...

Start Menu Layout Roaming on Windows 10

The Windows 10 Start menu layout is pain point for many users. What’s more, when utilizing roaming profile solutions, the Start menu layout might not be persistent when roaming across multiple desktops. We have described the reasons for this issue in this Citrix blog. The following is a workaroun...

CVE-2014-8708

Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature...

Design/Logic Flaw

Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature...

CVE-2014-8708

Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature...

CVE-2014-8708

Pluck CMS 4.7.2 is affected. A remote attacker can execute arbitrary code via the blog form feature, as reported by multiple sources (NVD/CNVD equivalents). Root cause details are not explicitly described in the provided documents beyond the blog form vector. No remediation or patch information i...

CVE-2014-8708: Undefined Security Weakness

Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature...

PT-2017-6265

Name of the Vulnerable Software and Affected Versions Pluck CMS version 4.7.2 Description The issue allows remote attackers to execute arbitrary code via the blog form feature. Recommendations For Pluck CMS version 4.7.2, at the moment, there is no information about a newer version that contains ...

phplist 3.2.6 Cross Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected phplist 3.2.6 Product: Fixed in: 3.3.1 Fixed Version https://sourceforge.net/projects/phplist/files/phplist/3.3.1/ Link: phplist-3.3.1.zip/download Vendor Website: https://www.phplist.org/ Vulnerability XSS Type: Remote Yes...

blogs.partner.microsoft.com XSS vulnerability

Vulnerable URL: https://blogs.partner.microsoft.com/mpn/top-social-media-tips-to-connect-with-customers/?ln=" menik Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No...

Internet Bug Bounty: Critical vulnerability in JSON Web Encryption (JWE) - RFC 7516 Invalid Curve attack

We found an issue in the JWE specification where it fails to warn the implementers about Invalid Curve attack. We found several libraries to be vulnerable : node-jose, jose2go, Nimbus JOSE+JWT and jose4j and in the process of filing an errata for the RFC. We report the vulnerabilities to the...

control.blog.sina.com.cn XSS vulnerability

Vulnerable URL: http://control.blog.sina.com.cn/riaapi/checklogin.php?callback=x'"--!confirmOPENBUGBOUNTY...

Logsign RCE Vulnerability (Mar 2017) - Active Check

Logsign is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:logsign:logsign"; ...

Linux/x86-64 - Polymorphic Flush IPTables Shellcode (47 bytes)

;The MIT License MIT ;Copyright c 2017 Robert L. Taylor ;Permission is hereby granted, free of charge, to any person obtaining a ;copy of this software and associated documentation files the “Software”, ;to deal in the Software without restriction, including without limitation ;the rights to use,...