WordPress 3.7.x < 3.7.17 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the PHPMailer component in the class.phpmailer.php script due to improper handling of sender email addresses. An...

RHEL 7 : zsh (RHSA-2018:3073)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3073 advisory. The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh...

CVE-2018-18745

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSMenu.php?lgid=1 during editing...

CVE-2018-18745

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSMenu.php?lgid=1 during editing...

CVE-2018-18741

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSDownload.php?lgid=1 during editing...

CVE-2018-18741

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSDownload.php?lgid=1 during editing...

Cross site scripting

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSMenu.php?lgid=1 during editing...

CVE-2018-18745

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSMenu.php?lgid=1 during editing...

CVE-2018-18741

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSDownload.php?lgid=1 during editing...

CVE-2018-18745: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSMenu.php?lgid=1 during editing...

NVP field - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-066

NVP field module allows you to create a field type of name/value pairs, with custom titles and easily editable rendering with customizable HTML/text surrounding the pairs. The module doesn't sufficiently handle sanitization of its field formatter's output. This vulnerability is mitigated by the...

[SECURITY] Fedora 29 Update: zsh-5.6.2-1.fc29

The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell the Korn shell, but includes many enhancements. Zsh supports command line editing, built-in spelling correction, programmable command completion, shell...

Shopify: H1514 Lack of access control on edit packing slip template

Summary: An admin is able to edit the Edit packing slip template at /admin/settings/packingsliptemplate. However, a staff user with only "Home" permission and none other can view and also make edits to this template. Description: The Edit packing slip feature exists so an admin user can customize...

Unexpected Error editing a layer, "The given key was not present in the dictionary."

You may find yourself unable to edit layers or publish images. These tasks fail in the App Layering Management Console with a cryptic message,"The given key was not present in the dictionary."...

CVE-2018-17369

CVE-2018-17369 affects the SpringBoot Authority project up to 2017-03-06, with a stored XSS vulnerability on the admin/role/edit page through the parameters roleKey, name, or description. The issue is documented across multiple sources (NVD, CNVD, CVE records) and is described as input-based stor...

[SECURITY] Fedora 27 Update: zsh-5.4.1-4.fc27

The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell the Korn shell, but includes many enhancements. Zsh supports command line editing, built-in spelling correction, programmable command completion, shell...

Mail.ru: Stored XSS

XSS in "Undo" functionality of message editing on replying to malformed message...

[SECURITY] Fedora 28 Update: zsh-5.5.1-2.fc28

The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell the Korn shell, but includes many enhancements. Zsh supports command line editing, built-in spelling correction, programmable command completion, shell...

Code injection

Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=editsnippet&filename=google-analytics URI, which allows attackers to execute arbitrary PHP code by placing this code after a ?php substring...

Debian DSA-4285-1 : sympa - security update

Michael Kaczmarczik discovered a vulnerability in the web interface template editing function of Sympa, a mailing list manager. Owner and listmasters could use this flaw to create or modify arbitrary files in the server with privileges of sympa user or owner view list config files even if...