Progress Sitefinity Information Disclosure Vulnerability

Progress Sitefinity is an open source platform for building corporate websites and intranets. A security vulnerability exists in Progress Sitefinity version 9.1, which stems from the fact that the wrapaccesstoken remains valid and is passed via a GET parameter after a session termination or...

CVE-2017-18091

The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the filename of a backu...

Progress Sitefinity Open Redirect Vulnerability

Progress Sitefinity is an open source platform for building corporate websites and intranets. An open redirect vulnerability exists in Authenticate/SWT in Progress Sitefinity version 9.1. An attacker can exploit this vulnerability to redirect users to arbitrary websites...

Progress Sitefinity Cross-Site Scripting Vulnerability (CNVD-2018-05678)

Progress Sitefinity is an open source platform for building corporate websites and intranets. A cross-site scripting vulnerability exists in Progress Sitefinity version 9.1. A remote attacker could exploit this vulnerability to access arbitrary information and functionality...

Progress Sitefinity Cross-Site Scripting Vulnerability

Progress Sitefinity is an open source platform for building corporate websites and intranets. A cross-site scripting vulnerability exists in Progress Sitefinity version 9.1. The vulnerability can be exploited by remote attackers to inject arbitrary web script or HTML via Content Management Templa...

Progress Sitefinity Cross-Site Scripting Vulnerability (CNVD-2018-05684)

Progress Sitefinity is an open source platform for building corporate websites and intranets. A cross-site scripting vulnerability exists in Progress Sitefinity version 9.1. The vulnerability can be exploited by remote attackers to inject malicious JavaScript code via the Last name, First name, a...

Design/Logic Flaw

Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1...

CVE-2017-18177

Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1...

CVE-2017-18175

Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration aka Templateconfiguration, as demonstrated by the src attribute of an IMG element. This is fixed in 10.1...

CVE-2017-18176

Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code. This is fixed in 10.1...

Default credentials

Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code. This is fixed in 10.1...

Open redirect

Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication token is sent to the redirection target, if the target is specified using a certain %40 syntax. This is fixed in 10.1...

Authentication flaw

Progress Sitefinity 9.1 uses wrapaccesstoken as a non-expiring authentication token that remains valid after a password change or a session termination. Also, it is transmitted as a GET parameter. This is fixed in 10.1...

Design/Logic Flaw

Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration aka Templateconfiguration, as demonstrated by the src attribute of an IMG element. This is fixed in 10.1...

CVE-2017-18179

Progress Sitefinity 9.1 uses wrapaccesstoken as a non-expiring authentication token that remains valid after a password change or a session termination. Also, it is transmitted as a GET parameter. This is fixed in 10.1...

CVE-2017-18175

Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration aka Templateconfiguration, as demonstrated by the src attribute of an IMG element. This is fixed in 10.1...

CVE-2017-18179

Progress Sitefinity 9.1 uses wrapaccesstoken as a non-expiring authentication token that remains valid after a password change or a session termination. Also, it is transmitted as a GET parameter. This is fixed in 10.1...

CVE-2017-18178

Progress Sitefinity 9.1 is affected by CVE-2017-18178, an open redirect in Authenticate/SWT where an authentication token may be sent to the redirection target when the target is specified using a particular %40 syntax. The issue is resolved in version 10.1. No exploitation details are provided i...

CVE-2017-18179

Progress Sitefinity 9.1 uses wrapaccesstoken as a non-expiring authentication token that remains valid after a password change or a session termination. Also, it is transmitted as a GET parameter. This is fixed in 10.1...

CVE-2017-18176

Progress Sitefinity 9.1 is affected by a cross‑site scripting (XSS) vulnerability triggered by file uploads, where JavaScript in an HTML file shares origin with the app’s code. Details from multiple sources confirm the issue and that it is fixed in Sitefinity 10.1. The root cause is an XSS condit...