5387 matches found
CVE-2016-7404
OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform...
Unsafe Lookup
ansible is vulnerable to unsafe lookups. The library does not wrap the jinja2 environment properly, resulting in the lookup results being rendered as unicode strings. This can result in arbitrary code being executed in the templates...
CVE-2017-2116
Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors...
CVE-2017-2116
Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors...
Authentication flaw
Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors...
CVE-2017-2116
Cybozu Office 10.0.0–10.5.0 contains an access restriction bypass in the templates delete function for the ustomapp eature, enabling remote authenticated attackers to delete ustomapp mplates via unspecified vectors. The CVE is CVE-2017-2116. The vulnerability is documented across multiple sourc...
CVE-2017-2116
Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors...
Trend Micro Control Manager cgiShowClientAdm Security Bypass
The version of Trend Micro Control Manager running on the remote host is affected by a security bypass vulnerability when processing calls to the cgiShowClientAdm web function due to a failure to provide authentication for the functionality that exposes, modifies, or deletes DLP templates involve...
Cybozu Office fails to restrict access permission in the templates delete function in "customapp"
Overview Cybozu Office contains an access restriction flaw in the templates delete function in "customapp". Cybozu, Inc. reported this vulnerabilities to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the Information Security Early Warning...
MODX Revolution 'setup/templates/findcore.php' file remote code execution vulnerability
MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A security vulnerability exists in the setup/templates/findcore.php file in MODX Revolution 2.5.4-pl and...
PYSEC-2017-62
Cross-site scripting XSS vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...
Cross site request forgery (csrf)
Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery CSRF attacks as demonstrated by editing user account information in the templates.asmx.cs file...
Authentication flaw
Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...
CVE-2016-4043
Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...
PYSEC-2017-57
Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...
CVE-2016-4043
Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...
Cross site scripting
IBM Social Rendering Templates for Digital Data Connector is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2016-8936
The CVE-2016-8936 entry concerns IBM Social Rendering Templates for Digital Data Connector. Available connected sources confirm a Cross-Site Scripting (XSS) vulnerability in the Web UI, which could allow an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trust...
Faraday v2.3 - Collaborative Penetration Test and Vulnerability Management Platform
Faraday is the Integrated Multiuser Risk Environment you were looking for! It maps and leverages all the knowledge you generate in real time, letting you track and understand your audits. Our dashboard for CISOs and managers uncovers the impact and risk being assessed by the audit in real-time...