Cross site request forgery (csrf)

EE 4GEE WiFi MBB before EE600005.0031 devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings...

CVE-2017-14269

EE 4GEE WiFi MBB before EE600005.0031 devices allow remote attackers to obtain sensitive information via a JSONP endpoint, as demonstrated by passwords and SMS content...

CVE-2017-14268

EE 4GEE WiFi MBB before EE600005.0031 devices have XSS in the smscontent parameter in a getSMSlist request...

CVE-2017-14269

CVE-2017-14269 affects EE 4GEE WiFi MBB devices (before EE60_00_05.00_31). The vulnerability allows remote attackers to obtain sensitive data via a JSONP endpoint, demonstrated as passwords and SMS content exposure. The root cause is an insecure JSONP/endpoint handling that leaks confidential inf...

CVE-2017-14267

EE 4GEE WiFi MBB before EE600005.0031 devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings...

CVE-2017-14267

EE 4GEE WiFi MBB devices (before EE60_00_05.00_31) are affected by a Cross‑Site Request Forgery (CSRF) vulnerability in admin actions exposed via goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings. The issue enables un...

CVE-2017-14268

EE 4GEE WiFi MBB before EE600005.0031 devices have XSS in the smscontent parameter in a getSMSlist request...

CVE-2017-14268

CVE-2017-14268 affects EE 4GEE WiFi MBB devices (before EE60_00_05.00_31). A Cross-Site Scripting (XSS) vulnerability exists in the sms_content parameter of a getSMSlist request. Exploitation context and impact are limited in the provided documents to input‑based script injection; no further expl...

EE 4GEE Wireless Router EE60_00_05.00_25 XSS / CSRF / Disclosure

EE 4GEE Wireless Router - Multiple Security Vulnerabilities Advisory ------------------------------------------------- Hardware Version/Model: 4GEE WiFi MBB EE60VB-2AE8G83. Vulnerable Software Version: EE600005.0025. Patched Software Version: EE600005.0031. Product URL:...

Apache Struts REST plugin XStream deserialization vulnerability

Added: 09/08/2017 CVE: CVE-2017-9805 BID: 100609 Background Apache Struts is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model-view-controller MVC architecture. Problem The REST plugi...

CVE-2017-12426

CVE-2017-12426 affects GitLab CE/EE: versions before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4, may allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import. CVSSv3 base score 8.8 (HIGH); CV...

CVE-2017-11437

GitLab Enterprise Edition EE before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirroring feature to potentially read repositories belonging to other users...

ladu24.ee XSS vulnerability

Vulnerable URL: https://www.ladu24.ee/varuosad/5/,,,,%253C%252Fscript%253E%253Cimg%2Bsrc%253Dx%2Bonerror%253Dprompt%2528%252FXSSPOSED%252F%2529%253Egsc.tab=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.10.2017 Vulnerability type:| XSS Vulnerability status:| Public...

CVE-2017-1000009

Akeneo PIM CE and EE are affected by a shell injection vulnerability in the mass edition feature for versions < 1.6.6, < 1.5.15, and

ladu24.ee XSS vulnerability

Vulnerable URL: https://www.ladu24.ee/varuosad/3/,,,,%253C%252Fscript%253E%253Cimg%2Bsrc%253Dx%2Bonerror%253Dprompt%2528%252FXSSPOSED%252F%2529%253Egsc.tab=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Public...

ladu24.ee XSS vulnerability

Vulnerable URL: https://www.ladu24.ee/varuosad/2/,,,,%253C%252Fscript%253E%253Cimg%2Bsrc%253Dx%2Bonerror%253Dprompt%2528%252FXSSPOSED%252F%2529%253Egsc.tab=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Public...

ladu24.ee XSS vulnerability

Vulnerable URL: https://www.ladu24.ee/varuosad/0/,,,,%253C%252Fscript%253E%253Cimg%2Bsrc%253Dx%2Bonerror%253Dprompt%2528%252FXSSPOSED%252F%2529%253Egsc.tab=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Public...

CVE-2016-9469

Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance. For GitLab instances with publicly available projects this vulnerability could be exploited by an unauthenticated user. A fix...

[SECURITY] Fedora 25 Update: springframework-security-3.2.10-1.fc25

Spring Security is a Java/Java EE framework that provides advanced authentication, authorization and other comprehensive security features for enterprise applications. In addition to having a comprehensive list of security functionality, Spring Security is very configurable and employs the Spring...

Cross-site Scripting Vulnerability in ZhengTong Content Management System

The GovContent Management System is a website management system designed and built on the JAVA EE platform, which is mainly used for the website construction and management of government agencies, enterprises and institutions. A cross-site scripting vulnerability exists in the CMS. The...