Design/Logic Flaw

Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder...

CVE-2017-8383

Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder...

CVE-2017-8385

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...

CVE-2017-8384

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...

CVE-2017-8384

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...

CVE-2017-8383

Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder...

CVE-2017-8383

Craft CMS prior to 2.6.2976 contains an information-disclosure vulnerability where access to files under the craft/app/ directory is not properly restricted. The issue allows potential exposure of sensitive information. Root cause is insufficient access controls within the affected file path. Aff...

CVE-2017-8384

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...

CVE-2017-8385

CVE-2017-8385 affects Craft CMS prior to 2.6.2976. The vulnerability is that the forgot-password email URL can be modified by an attacker, indicating a URL forgery/URL tampering issue within the password-reset flow. The available documented impact is the ability to alter the reset URL, with no ex...

CVE-2017-8383

Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder...

CVE-2017-8384

Craft CMS has a vulnerability CVE-2017-8384 (pre-2.6.2976) that enables XSS when HttpRequestService::getSegments() and getActionSegments() return arrays that need not be zero-based. The root cause is tied to an incomplete fix for CVE-2017-8052, per related advisories. Impact is Cross-Site Scripti...

CVE-2017-8385

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...

Craft CMS Cross-Site Scripting Vulnerability

Craft CMS is a content management system CMS developed by Craft. A cross-site scripting vulnerability exists in Craft CMS versions prior to 2.6.2974. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

CVE-2017-8052

Craft CMS before 2.6.2974 allows XSS attacks...

CVE-2017-8052

Craft CMS before 2.6.2974 allows XSS attacks...

Cross site scripting

Craft CMS before 2.6.2974 allows XSS attacks...

CVE-2017-8052

Craft CMS before 2.6.2974 allows XSS attacks...

CVE-2017-8052

CVE-2017-8052 affects Craft CMS prior to 2.6.2974, enabling XSS. The vulnerability arises in Craft’s handling of user-supplied input; the initial entry assigns a MEDIUM base CVSS (6.1) on CVSS3, with network vector and user interaction required. Public references tie the issue to an incomplete fi...

Trend Micro Threat Discovery Appliance 2.6.1062r1 dlp_policy_upload.cgi Remote Code Execution

!/usr/local/bin/python """ Trend Micro Threat Discovery Appliance /opt/TrendMicro/MinorityReport/bin/ Then, all we do is create /engptnstores/prod/sensorSDK/data/si/dlpkill.sh with malicious code and get it executed... Notes: ====== - For this particular PoC, all I did was exec a bind shell using...

Google Android Mediaserver Denial of Service Vulnerability (CNVD-2017-05713)

Google Android is a mobile operating system based on the Linux open kernel. Google Android has a security vulnerability in the implementation of the Mediaserver component, which allows remote attackers to exploit the vulnerability to build special applications that can crash the service process a...