PT-2018-9851

Name of the Vulnerable Software and Affected Versions: Users plugin version 1.4.5 for October CMS Description: A cross-site scripting XSS issue exists in the name field of the Users plugin for October CMS. Recommendations: For version 1.4.5, consider disabling the name field in the Users plugin...

MS03-040: October, 2003, Cumulative Patch for Internet Explorer

Technical Updates October 1, 2003: Originally published.October 15, 2003: Updated the "Prerequisites" section to indicate that you can install the security patch on Windows NT Workstation 4.0 SP6a and Windows 2000 SP2.Symptoms This is a cumulative security patch for Microsoft Internet Explorer th...

MS11-078: Description of the security update for the .NET Framework 3.5.1 for Windows 7 and Windows Server 2008 R2: October 11, 2011

MS11-078: Description of the security update for the .NET Framework 3.5.1 for Windows 7 and Windows Server 2008 R2: October 11, 2011 Introduction Microsoft has released security bulletin MS11-078. To view the complete security bulletin, visit one of the following Microsoft websites: Home users:...

MS11-078: Description of the security update for .NET Framework 3.5.1 for Windows 7 SP1 and Windows Server 2008 R2 SP1: October 11, 2011

MS11-078: Description of the security update for .NET Framework 3.5.1 for Windows 7 SP1 and Windows Server 2008 R2 SP1: October 11, 2011 Introduction Microsoft has released security bulletin MS11-078. To view the complete security bulletin, visit one of the following Microsoft websites: Home user...

October CMS < 1.0.431 - Cross-Site Scripting

Exploit Title: October CMS Stored Code Injection Date: 16-02-2018 Exploit Author: Samrat Das Contact: http://twitter.com/SamratDas93 Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://octobercms.com/ Version: All versions till date from 1.0.431 CVE : CVE- 2018-7198 Category:...

October CMS 1.0.431 - Cross-Site Scripting

October CMS 1.0.431 - Cross-Site Scripting ​​ Exploit Title: October CMS Stored Code Injection Date: 16-02-2018 Exploit Author: Samrat Das Contact: http://twitter.com/SamratDas93 Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://octobercms.com/ Version: All versions till dat...

October CMS Cross Site Scripting

Exploit Title: October CMS Stored Code Injection Date: 16-02-2018 Exploit Author: Samrat Das Contact: http://twitter.com/SamratDas93 Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://octobercms.com/ Version: All versions till date from 1.0.431 CVE : CVE- 2018-7198 Category:...

Deserialization of untrusted data

October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...

CVE-2018-7198

October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...

CVE-2018-7198

October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...

CVE-2018-7198

October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...

CVE-2018-7198

CVE-2018-7198 affects October CMS up to version 1.0.431, specifically the RainLab Blog Plugin. It enables stored XSS by entering HTML on the Add Posts page, allowing a malicious payload to be stored and subsequently executed. The issue is documented across multiple sources (GHSA/OSV and exploit r...

PT-2018-17944

Name of the Vulnerable Software and Affected Versions October CMS versions through 1.0.431 The RainLab Blog Plugin used in October CMS versions through 1.0.431 Description The issue allows for XSS by entering HTML on the Add Posts page. This can be exploited through the RainLab Blog Plugin...

CVE-2018-7198: Improper Neutralization of Input During Web Page Generation

October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...

mysql: insecure error log file handling in mysqld_safe (CPU Oct 2016)

A flaw was found in the way the mysqldsafe script handled creation of error log file. The mysql operating system user could use this flaw to escalate their privileges to root...

mysql: insecure error log file handling in mysqld_safe (CPU Oct 2016)

A flaw was found in the way the mysqldsafe script handled creation of error log file. The mysql operating system user could use this flaw to escalate their privileges to root...

October CMS Code Execution Vulnerability

October CMS is an open source, self-hosted content management system CMS built on the Laravel PHP framework developed by Canadian software developer Alexey Bobkov and Australian software developer Samuel Georges. A security vulnerability exists in October CMS 1.0.428 and earlier versions, which...

Design/Logic Flaw

DISPUTED October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file...

CVE-2017-16941

October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a...

CVE-2017-16941

October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a...