CVE-2018-18087

The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/$projecttitle...

CVE-2018-18087

The CVE concerns the Pagekit Bixie Portfolio plugin 1.2.0 . Affected component: the portfolio editor’s Image URL field . Root cause: an XSS vulnerability allowing a logged-in user with the Manage portfolio privilege to inject arbitrary script/HTML, triggered by visiting the URL path /portfolio/${...

CVE-2018-18087: Improper Neutralization of Input During Web Page Generation

The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/$projecttitle...

PT-2018-14341

Name of the Vulnerable Software and Affected Versions Bixie Portfolio plugin version 1.2.0 Description The issue allows a logged-in user with the "Manage portfolio" privilege to inject arbitrary web script or HTML via the Image URL field in the portfolio editor. This is triggered by visiting the...

Component Responsive Portfolio 'filter_order_Dir' SQL Injection Vulnerability in Joomla!

Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. A SQL injection vulnerability exists in the Responsive Portfolio 'filterorderDir' component of Joomla! An attacker can execute SQL commands by including vulnerable parameters...

Joomla Responsive Portfolio 1.6.1 Component - filter_order_Dir SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component Responsive Portfolio 1.6.1 - 'filterorderDir' SQL Injection Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://extro.media/ Software Link:...

Joomla! Responsive Portfolio 1.6.1 SQL Injection

Exploit Title: Joomla! Component Responsive Portfolio 1.6.1 - 'filterorderDir' SQL Injection Dork: N/A Date: 2018-09-25 Exploit Author: Azkan Mustafa AkkuA AkkuS Vendor Homepage: https://extro.media/ Software Link: https://extensions.joomla.org/extension/rpc-responsive-portfolio/ Version: 1.6.1...

CA PPM XML External Entity Vulnerability

CA PPM is a suite of project and portfolio management software from CA USA. The software includes features such as task management, project planning, financial reporting management and resource management. An XML external entity injection vulnerability exists in the XOG functionality in CA PPM. A...

CA PPM Cross-Site Scripting Vulnerability

CA PPM is a suite of project and portfolio management software from CA USA. The software includes features such as task management, project planning, financial reporting management and resource management. A cross-site scripting vulnerability exists in the gridExcelExport feature in CA PPM, which...

CA PPM XML External Entity Vulnerability (CNVD-2018-17420)

CA PPM is a suite of project and portfolio management software from CA USA. The software includes features such as task management, project planning, financial reporting management and resource management. An XML external entity injection vulnerability exists in the XOG functionality in CA PPM. A...

CA PPM SSL Password Plaintext Storage Vulnerability

CA PPM is a suite of project and portfolio management software from CA USA. The software includes features such as task management, project planning, financial reporting management and resource management. A security vulnerability exists in CA PPM that originates from the program storing SSL...

CA PPM SQL Injection Vulnerability

CA PPM is a suite of project and portfolio management software from CA USA. The software includes features such as task management, project planning, financial reporting management and resource management. A SQL injection vulnerability exists in CA PPM that stems from the program's inadequate...

CVE-2018-13822

Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to access sensitive information...

PortfolioCMS Cross-Site Request Forgery Vulnerability

portfolioCMS is a content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in portfolioCMS version 1.0.5. A remote attacker can exploit this vulnerability to create a new page with admin/portfolio.php?newpage=true...

Vimeo: Domain pointing to vimeo portfolio are prone to takeover using on-demand.

We thank @bugdiscloseguys for finding this issue. We were only checking \ on-demand to on-demand, but not on-demand to portfolio. Vimeo offers service for pro users to add custom domain under portfolios so that portfolios can be hosted on your subDomain, However Vimeo offers same feature for...

CVE-2018-2960

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.x, 16.x and 17.x. Easily exploitable vulnerability allows unauthenticated attacker with netwo...

CVE-2018-2960

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.x, 16.x and 17.x. Easily exploitable vulnerability allows unauthenticated attacker with netwo...

CVE-2018-2962

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.x, 16.x and 17.x. Difficult to exploit vulnerability allows low privileged attacker with...

Design/Logic Flaw

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.x, 16.x and 17.x. Easily exploitable vulnerability allows unauthenticated attacker with netwo...

CVE-2018-2962

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.x, 16.x and 17.x. Difficult to exploit vulnerability allows low privileged attacker with...