3103 matches found
Concrete CMS: Stored XSS vulnerability in additional URLs in 'Location' dialog [Sitemap]
Intro "Transformers: Dark of the Crayons" Type of issue: Core CMS issue Level of severity: Internal Attack Vector Concrete5 version: 8.2.0 RC2 rev. 0a26b63c4a64d42e7afb36aba0a6e4d1f4c53d7d July 19th Summary There is Stored XSS vulnerability in additional URLs in 'Location' dialog. This issue can ...
CVE-2017-7977
The Screensavercc component in eLux RP before 5.5.0 allows attackers to bypass intended configuration restrictions and execute arbitrary commands with root privileges by inserting commands in a local configuration dialog in the control panel...
CVE-2017-7977: Improper Neutralization of Special Elements used in a Command
The Screensavercc component in eLux RP before 5.5.0 allows attackers to bypass intended configuration restrictions and execute arbitrary commands with root privileges by inserting commands in a local configuration dialog in the control panel...
CVE-2017-9248
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leadi...
CFME: Dialog for creating cloud volumes does not filter cloud tenants CVE-2017-7497
The dialog for creating cloud volumes cinder provider in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant...
openSUSE: Security Advisory for java-1_8_0-openjdk (openSUSE-SU-2017:1507-1)
The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
OTRS Install Dialog Disclosure
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2017-018 Product: OTRS Manufacturer: OTRS Affected Versions: OTRS 5.0.x, OTRS 4.0.x, OTRS 3.3.x Fixed Versions: OTRS 5.0.20, OTRS 4.0.24, OTRS 3.3.17 Tested Versions: 5.0.19 Vulnerability Type: Access to Installation Dialog Risk...
PT-2017-4022
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 56 Description The issue is related to the use of the "data:" protocol in Firefox, which can be exploited to create a modal dialog through JavaScript. This allows an attacker to spoof the origin of the modal dialog,...
May 25, 2017âKB4020102 (OS Build 15063.332)
None None...
Concrete CMS: Stored XSS in Pages SEO dialog Name field (concrete5 8.1.0)
Intro First things first, so... Crayons, crayons everywhere : Type of issue: Core CMS issue Level of severity: Internal Attack Vector Concrete5 version: 8.1.0 Summary There is Stored XSS vulnerability in Name field SEO dialog for pages. Malicious user is able to prepare payload which is then...
CVE-2017-9064
In WordPress before 4.7.5, a Cross Site Request Forgery CSRF vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials...
Cross site request forgery (csrf)
In WordPress before 4.7.5, a Cross Site Request Forgery CSRF vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials...
DEBIAN-CVE-2017-9064
In WordPress before 4.7.5, a Cross Site Request Forgery CSRF vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials...
CVE-2017-9064
In WordPress before 4.7.5, a Cross Site Request Forgery CSRF vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials...
CVE-2017-9064
In WordPress before 4.7.5, a Cross Site Request Forgery CSRF vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials...
CVE-2017-9064
CVE-2017-9064 affects WordPress prior to 4.7.5. The vulnerability is a CSRF in the filesystem credentials dialog where updating credentials does not require a nonce, enabling unauthorized credential changes. The issue is validated by the description in the initial document; no exploitation status...
PT-2017-18680
Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.7.5 Description A Cross Site Request Forgery CSRF issue exists in the filesystem credentials dialog. This occurs because a nonce is not required for updating credentials. Recommendations For versions prior to 4.7....
CVE-2017-9064: Cross-Site Request Forgery (CSRF)
In WordPress before 4.7.5, a Cross Site Request Forgery CSRF vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials...
Smart related articles SQL Injection Vulnerability
Smart related articles is a content management system extension. An SQL injection vulnerability exists in Smart related articles 'dialog.php' for Joomla! An attacker must use the searchcats variable in the POST method to exploit this vulnerability and obtain sensitive database information...
Smart related articles missing _JEXEC check vulnerability
Smart related articles is a content management system extension. A security vulnerability exists in Smart related articles for Joomla! allows an attacker to fail to block direct requests to dialog.php missing JEXEC check...