CVE-2017-8384

Craft CMS has a vulnerability CVE-2017-8384 (pre-2.6.2976) that enables XSS when HttpRequestService::getSegments() and getActionSegments() return arrays that need not be zero-based. The root cause is tied to an incomplete fix for CVE-2017-8052, per related advisories. Impact is Cross-Site Scripti...

CVE-2017-8383

Craft CMS prior to 2.6.2976 contains an information-disclosure vulnerability where access to files under the craft/app/ directory is not properly restricted. The issue allows potential exposure of sensitive information. Root cause is insufficient access controls within the affected file path. Aff...

CVE-2017-8385

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...

CVE-2017-8383

Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder...

CVE-2017-8384

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...

CVE-2017-8385

CVE-2017-8385 affects Craft CMS prior to 2.6.2976. The vulnerability is that the forgot-password email URL can be modified by an attacker, indicating a URL forgery/URL tampering issue within the password-reset flow. The available documented impact is the ability to alter the reset URL, with no ex...

Craft CMS Cross-Site Scripting Vulnerability

Craft CMS is a content management system CMS developed by Craft. A cross-site scripting vulnerability exists in Craft CMS versions prior to 2.6.2974. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

CVE-2017-8052

Craft CMS before 2.6.2974 allows XSS attacks...

CVE-2017-8052

Craft CMS before 2.6.2974 allows XSS attacks...

Cross site scripting

Craft CMS before 2.6.2974 allows XSS attacks...

CVE-2017-8052

CVE-2017-8052 affects Craft CMS prior to 2.6.2974, enabling XSS. The vulnerability arises in Craft’s handling of user-supplied input; the initial entry assigns a MEDIUM base CVSS (6.1) on CVSS3, with network vector and user interaction required. Public references tie the issue to an incomplete fi...

CVE-2017-8052

Craft CMS before 2.6.2974 allows XSS attacks...

Trend Micro Threat Discovery Appliance 2.6.1062r1 dlp_policy_upload.cgi Remote Code Execution

!/usr/local/bin/python """ Trend Micro Threat Discovery Appliance /opt/TrendMicro/MinorityReport/bin/ Then, all we do is create /engptnstores/prod/sensorSDK/data/si/dlpkill.sh with malicious code and get it executed... Notes: ====== - For this particular PoC, all I did was exec a bind shell using...

Google Android Mediaserver Denial of Service Vulnerability (CNVD-2017-05713)

Google Android is a mobile operating system based on the Linux open kernel. Google Android has a security vulnerability in the implementation of the Mediaserver component, which allows remote attackers to exploit the vulnerability to build special applications that can crash the service process a...

Google Android Mediaserver Code Execution Vulnerability (CNVD-2017-04725)

Google Android is a mobile operating system based on the Linux open kernel. Google Android suffers from a security vulnerability in the Mediaserver implementation, which allows remote attackers to exploit the vulnerability to construct special media files and trick users into parsing them, which...

CVE-2017-7592

The putagreytile function in tifgetimage.c in LibTIFF 4.0.7 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted image...

CVE-2015-8954

The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might allow remote attackers to bypass intrusion-prevention functionality via a crafted HTTP request...

Survival Craft: Exploration - Corrupted files, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Survival Craft: Exploration published at the 'play' market has multiple vulnerabilities...

Microsoft Internet Explorer Information Disclosure (MS16-144: CVE-2016-7278)

An information disclosure vulnerability exists in Internet Explorer. The vulnerability is due to the way Internet Explorer do not properly handle objects in memory. A remote attacker could exploit this vulnerability by enticing the target user to open a specially crafted website...

pcre: buffer overflow caused by recursive back reference by name within certain group (8.38/4)

Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by /^?P=B?P=B?J:?Pc?Pa?P=BWGXCREDITS/, a different vulnerability than CVE-2015-8384...