Concrete CMS: Stored XSS vulnerability in additional URLs in 'Location' dialog [Sitemap]

Intro "Transformers: Dark of the Crayons" Type of issue: Core CMS issue Level of severity: Internal Attack Vector Concrete5 version: 8.2.0 RC2 rev. 0a26b63c4a64d42e7afb36aba0a6e4d1f4c53d7d July 19th Summary There is Stored XSS vulnerability in additional URLs in 'Location' dialog. This issue can ...

CVE-2017-7977

The Screensavercc component in eLux RP before 5.5.0 allows attackers to bypass intended configuration restrictions and execute arbitrary commands with root privileges by inserting commands in a local configuration dialog in the control panel...

CVE-2017-9248

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leadi...

CFME: Dialog for creating cloud volumes does not filter cloud tenants CVE-2017-7497

The dialog for creating cloud volumes cinder provider in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant...

openSUSE: Security Advisory for java-1_8_0-openjdk (openSUSE-SU-2017:1507-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OTRS Install Dialog Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2017-018 Product: OTRS Manufacturer: OTRS Affected Versions: OTRS 5.0.x, OTRS 4.0.x, OTRS 3.3.x Fixed Versions: OTRS 5.0.20, OTRS 4.0.24, OTRS 3.3.17 Tested Versions: 5.0.19 Vulnerability Type: Access to Installation Dialog Risk...

May 25, 2017—KB4020102 (OS Build 15063.332)

None None...

Concrete CMS: Stored XSS in Pages SEO dialog Name field (concrete5 8.1.0)

Intro First things first, so... Crayons, crayons everywhere : Type of issue: Core CMS issue Level of severity: Internal Attack Vector Concrete5 version: 8.1.0 Summary There is Stored XSS vulnerability in Name field SEO dialog for pages. Malicious user is able to prepare payload which is then...

CVE-2017-9064

In WordPress before 4.7.5, a Cross Site Request Forgery CSRF vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials...

Cross site request forgery (csrf)

In WordPress before 4.7.5, a Cross Site Request Forgery CSRF vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials...

CVE-2017-9064

In WordPress before 4.7.5, a Cross Site Request Forgery CSRF vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials...

DEBIAN-CVE-2017-9064

In WordPress before 4.7.5, a Cross Site Request Forgery CSRF vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials...

CVE-2017-9064

CVE-2017-9064 affects WordPress prior to 4.7.5. The vulnerability is a CSRF in the filesystem credentials dialog where updating credentials does not require a nonce, enabling unauthorized credential changes. The issue is validated by the description in the initial document; no exploitation status...

Smart related articles missing _JEXEC check vulnerability

Smart related articles is a content management system extension. A security vulnerability exists in Smart related articles for Joomla! allows an attacker to fail to block direct requests to dialog.php missing JEXEC check...

Smart related articles cross-site scripting vulnerability

Smart related articles is a content management system extension. A cross-site scripting vulnerability exists in dialog.php in Smart related articles for Joomla!...

Smart related articles SQL Injection Vulnerability

Smart related articles is a content management system extension. An SQL injection vulnerability exists in Smart related articles 'dialog.php' for Joomla! An attacker must use the searchcats variable in the POST method to exploit this vulnerability and obtain sensitive database information...

CVE-2017-7626

The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php nart,type in GET Method...

CVE-2017-7628

The "Smart related articles" extension 1.1 for Joomla! has SQL injection in dialog.php attacker must use searchcats variable in POST method to exploit this vulnerability...

Android Dialog Denial of Service Vulnerability

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Consortium. A denial of service vulnerability exists in the Android system dialog. The vulnerability is caused by the system-level Intent mechanism "android.intent.action.CLOSESYSTEMDIALOGS" in...

jQuery UI Cross-Site Scripting Vulnerability

jQuery UI is a set of JavaScript libraries developed by the jQuery team that provides abstracted, themeable GUI controls and animations, and supports the construction of interactive Internet applications. A cross-site scripting vulnerability exists in jQuery UI versions prior to 1.12.0. A remote...