CVE-2018-18373: Improper Neutralization of Input During Web Page Generation

In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the Chat and Help Desk sections via the msg parameter in a /wp-admin/admin-ajax.php sbajaxaddmessage action...

PT-2018-14420

Name of the Vulnerable Software and Affected Versions Schiocco Support Board - Chat And Help Desk plugin version 1.2.3 Description A Stored XSS issue has been found in the file upload areas of the Chat and Help Desk sections. This is achieved via the msg parameter in the "/wp-admin/admin-ajax.php...

org.apache.camel:camel-mail-starter (2.22.0), org.nhind:direct-msg-monitor (>=6.0, <=8.1.0) +3 more potentially affected by CVE-2018-8041 via org.apache.camel:camel-mail (2.22.0)

org.apache.camel:camel-mail MAVEN version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-mail and may be impacted: - org.apache.camel:camel-mail-starter 2.22.0 - org.nhind:direct-msg-monitor =6.0, =6.0, =6.0, =8.1.0 -...

org.apache.qpid:qpid-bdbstore (0.26), org.apache.qpid:qpid-broker (0.26) +2 more potentially affected by CVE-2016-4432 via org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol (0.26)

org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol MAVEN version 0.26 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol and may be impacted: - org.apache.qpid:qpid-bdbstore 0.26 -...

org.apache.qpid:qpid-broker (0.26), org.apache.qpid:qpid-broker-plugins-amqp-msg-conv-0-10-to-1-0 (0.26) +1 more potentially affected by CVE-2016-4432 via org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol (0.26)

org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol MAVEN version 0.26 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol and may be impacted: - org.apache.qpid:qpid-broker 0.26 -...

org.apache.qpid:qpid-bdbstore (>=6.0.0, <=6.0.2), org.apache.qpid:qpid-bdbstore-jmx (>=6.0.0, <=6.0.2) +3 more potentially affected by CVE-2016-4432 via org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol (>=6.0.0, <=6.0.2)

org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.2 Source cves: CVE-2016-4432 Source advisory: OSV:GHSA-Q66C-H853-GQW2...

msg-topgen (>=0.1.4, <=0.1.7) potentially affected by CVE-2016-3096 via ansible (2.0.0.0)

ansible PYPI version 2.0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ansible and may be impacted: - msg-topgen =0.1.4, =0.1.7 Source cves: CVE-2016-3096 Source advisory: GHSA-RH6X-QVG7-RRMJ...

msg-topgen (>=0.1.4, <=0.1.7) potentially affected by CVE-2016-3096 via ansible (2.0.0.0)

ansible PYPI version 2.0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ansible and may be impacted: - msg-topgen =0.1.4, =0.1.7 Source cves: CVE-2016-3096 Source advisory: OSV:GHSA-RH6X-QVG7-RRMJ...

cloudmesh-client (>=4.2.6, <=4.4.0), k8sdc (>=0.0.11, <=0.0.20) +2 more potentially affected by CVE-2016-8647 via ansible (>=2.0.0.0, <=2.1.2.0)

ansible PYPI version =2.0.0.0, =4.2.6, =0.0.11, =0.1.4, =0.1.7, =0.1.14 Source cves: CVE-2016-8647 Source advisory: OSV:GHSA-X4CM-M36H-C6QJ...

cloudmesh-client (>=4.2.6, <=4.4.0), k8sdc (>=0.0.11, <=0.0.20) +2 more potentially affected by CVE-2016-8614 via ansible (>=2.0.0.0, <=2.1.2.0)

ansible PYPI version =2.0.0.0, =4.2.6, =0.0.11, =0.1.4, =0.1.7, =0.1.14 Source cves: CVE-2016-8614 Source advisory: OSV:GHSA-CMWX-9M2H-X7V4...

cloudmesh-client (>=4.2.6, <=4.4.0), k8sdc (>=0.0.11, <=0.0.20) +2 more potentially affected by CVE-2016-8628 via ansible (>=2.0.0.0, <=2.1.2.0)

ansible PYPI version =2.0.0.0, =4.2.6, =0.0.11, =0.1.4, =0.1.7, =0.1.14 Source cves: CVE-2016-8628 Source advisory: OSV:GHSA-JG4F-JQM5-4MGQ...

cloudmesh-client (>=4.2.6, <=4.4.0), k8sdc (>=0.0.11, <=0.0.20) +2 more potentially affected by CVE-2016-9587 via ansible (>=2.0.0.0, <=2.1.2.0)

ansible PYPI version =2.0.0.0, =4.2.6, =0.0.11, =0.1.4, =0.1.7, =0.1.14 Source cves: CVE-2016-9587 Source advisory: OSV:GHSA-M956-FRF4-M2WR...

cloudmesh-client (>=4.2.6, <=4.4.0), k8sdc (>=0.0.11, <=0.0.20) +2 more potentially affected by CVE-2016-9587 via ansible (>=2.0.0.0, <=2.1.2.0)

ansible PYPI version =2.0.0.0, =4.2.6, =0.0.11, =0.1.4, =0.1.7, =0.1.14 Source cves: CVE-2016-9587 Source advisory: GHSA-M956-FRF4-M2WR...

DedeCMS Cross-Site Scripting Vulnerability (CNVD-2018-19871)

DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the /plus/feedbackajax.php file in DedeCMS version 5.7 SP2, which can be exploited by remote attackers to execute JavaScript code with the help of the onhashchange attribute in the 'msg'...

PT-2018-13748

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 SP2 Description The issue allows for XSS via an onhashchange attribute in the msg parameter to "/plus/feedback ajax.php" API endpoint. Recommendations For DedeCMS version 5.7 SP2, consider restricting access to the...

CVE-2018-16786: Improper Neutralization of Input During Web Page Generation

DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedbackajax.php...

cloudmesh-client (>=4.2.6, <=4.4.0), k8sdc (>=0.0.11, <=0.0.20) +2 more potentially affected by CVE-2017-7481 via ansible (>=2.0.0.0, <=2.1.2.0)

ansible PYPI version =2.0.0.0, =4.2.6, =0.0.11, =0.1.4, =0.1.7, =0.1.14 Source cves: CVE-2017-7481 Source advisory: GHSA-W578-J992-554X...

cloudmesh-client (>=4.2.6, <=4.4.0), k8sdc (>=0.0.11, <=0.0.20) +2 more potentially affected by CVE-2017-7481 via ansible (>=2.0.0.0, <=2.1.2.0)

ansible PYPI version =2.0.0.0, =4.2.6, =0.0.11, =0.1.4, =0.1.7, =0.1.14 Source cves: CVE-2017-7481 Source advisory: OSV:GHSA-W578-J992-554X...

PT-2018-13107

Name of the Vulnerable Software and Affected Versions Dropbear versions prior to 2018.76 Description The issue is related to a user enumeration problem in the recv msg userauth request function. This function is located in svr-auth.c and is prone to a vulnerability because the validity of usernam...

ansible-flow (0.1.0), cloudmesh-client (>=4.2.6, <=4.4.0) +4 more potentially affected by CVE-2016-8614 via ansible (>=1.9.4, <=2.1.2.0)

ansible PYPI version =1.9.4, =4.2.6, =0.0.11, =0.1.4, =1.0.0, =0.1.7, =0.1.14 Source cves: CVE-2016-8614 Source advisory: MEND:CVE-2016-8614...