3094 matches found
Craft CMS 2.6 - Cross-Site Scripting
Exploit Title: Craft CMS 2.6 - Cross-Site Scripting/Unrestricted File Upload Date: 2017-06-08 Exploit Author: Ahsan Tahir Vendor Homepage: https://craftcms.com Software Link: http://download.craftcdn.com/craft/2.6/2.6.2981/Craft-2.6.2981.zip Version: 2.6 Tested on: Kali Linux 2.0 | Windows 8.1...
CVE-2017-1125
IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents of a file. IBM X-Force ID: 121340...
Craft CMS 2.6 Cross Site Scripting / File Upload
Exploit Title: Craft CMS 2.6 - Cross-Site Scripting/Unrestricted File Upload Date: 2017-06-08 Exploit Author: Ahsan Tahir Vendor Homepage: https://craftcms.com Software Link: http://download.craftcdn.com/craft/2.6/2.6.2981/Craft-2.6.2981.zip Version: 2.6 Tested on: Kali Linux 2.0 | Windows 8.1...
CVE-2017-2500
An issue was discovered in certain Apple products. Safari before 10.1.1 is affected. The issue involves the "Safari" component. It allows remote attackers to spoof the address bar via a crafted web site...
[ASA-201705-15] zziplib: multiple issues
Arch Linux Security Advisory ASA-201705-15 ========================================== Severity: High Date : 2017-05-12 CVE-ID : CVE-2017-5974 CVE-2017-5975 CVE-2017-5976 CVE-2017-5979 CVE-2017-5981 Package : zziplib Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-191...
Craft CMS Cross-Site Scripting Vulnerability
Craft CMS is a content management system CMS for developers and content managers. A cross-site scripting vulnerability exists in Craft CMS versions prior to 2.6.2976. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
Craft CMS Information Disclosure Vulnerability
Craft CMS is a content management system CMS for developers and content managers. A security vulnerability exists in Craft CMS versions prior to 2.6.2976, which stems from the program failing to properly restrict viewing of the contents of the craft/app/folder. An attacker could exploit this...
Craft CMS Security Bypass Vulnerability
Craft CMS is a content management system CMS for developers and content managers. A security bypass vulnerability exists in Craft CMS versions prior to 2.6.2976. An attacker can exploit this vulnerability to perform unauthorized operations...
CVE-2017-8383
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder...
CVE-2017-8384
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...
CVE-2017-8385
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...
CVE-2017-8383
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder...
Design/Logic Flaw
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder...
Default credentials
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...
CVE-2017-8385
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...
Cross site scripting
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...
CVE-2017-8384
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...
CVE-2017-8384
Craft CMS has a vulnerability CVE-2017-8384 (pre-2.6.2976) that enables XSS when HttpRequestService::getSegments() and getActionSegments() return arrays that need not be zero-based. The root cause is tied to an incomplete fix for CVE-2017-8052, per related advisories. Impact is Cross-Site Scripti...
