CVE-2017-15213: Improper Neutralization of Input During Web Page Generation

Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via the realname or emailaddress field to themes/CleanFS/templates/common.editallusers.tpl...

Cross site scripting

The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting XSS affecting a vanity-urls Title field, a containers Description field, and a templates Description field...

CVE-2017-15219

The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting XSS affecting a vanity-urls Title field, a containers Description field, and a templates Description field...

CVE-2017-15219

The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting XSS affecting a vanity-urls Title field, a containers Description field, and a templates Description field...

CVE-2017-15219

The CVE-2017-15219 entry concerns the dotCMS 4.1.1 application with a Stored Cross-Site Scripting (XSS) vulnerability. Affected fields include vanity-urls Title, containers Description, and templates Description, with exploitation arising from insufficient input filtering of user-submitted conten...

CVE-2017-15219

The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting XSS affecting a vanity-urls Title field, a containers Description field, and a templates Description field...

CVE-2017-15219: Improper Neutralization of Input During Web Page Generation

The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting XSS affecting a vanity-urls Title field, a containers Description field, and a templates Description field...

PT-2017-13914

Name of the Vulnerable Software and Affected Versions dotCMS version 4.1.1 Description The issue affects the dotCMS application, where a Stored Cross-Site Scripting XSS vulnerability is present. This vulnerability impacts the Title field of vanity-urls, the Description field of containers, and th...

PT-2017-13908

Name of the Vulnerable Software and Affected Versions Flyspray versions prior to 1.0-rc6 Description The issue allows an authenticated user to inject JavaScript and gain administrator privileges. This is achieved by exploiting the real name or email address field in the...

How to Protect AWS ECS with SecureSphere WAF

Adoption of container technology is growing widely. More and more workloads are being transferred from traditional EC2 compute instances to container-based services. However, the need for securing the web traffic remains the same regardless of the elected platform. In this post, we’ll deep dive...

CVE-2017-12794

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you...

Luckystrike - A PowerShell based utility for the creation of malicious Office macro documents

A PowerShell based utility for the creation of malicious Office macro documents. To be used for pentesting or educational purposes only. Luckystrike is a menu-drive SET style PowerShell-based generator of malicious .xls and .doc documents. All your payloads are saved into a database for easy...

Apache OFBiz Freemarker Instruction Code Execution Vulnerability

Apache OFBiz is an enterprise resource planning system from the Apache Software Foundation in the United States. Apache OFBiz has a security vulnerability in passing valid Freemarker commands to the Template Engine, allowing remote attackers to exploit the vulnerability to construct special...

SUSE-SU-2017:2315-1 Security update for libreoffice

LibreOffice was updated to version 5.3.5.2, bringing new features and enhancements: Writer: - New 'Go to Page' dialog for quickly jumping to another page. - Support for 'Table Styles'. - New drawing tools were added. - Improvements in the toolbar. - Borderless padding is displayed. Calc: - New...

ansible: Security issue with lookup return not tainting the jinja2 environment

An input validation flaw was found in Ansible, where it fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the...

How to Protect AWS API Gateway with SecureSphere WAF

Serverless architectures are becoming more and more popular, and Amazon’s API Gateway service is a key factor in many serverless deployments on AWS. Currently API Gateway only supports a public CloudFront endpoint, and securing the API Gateway with high-end WAF protection may seem like a difficul...

PT-2017-9395

Name of the Vulnerable Software and Affected Versions GigaCC OFFICE versions 2.3 and earlier Description The issue allows remote attackers to execute arbitrary OS commands via specially crafted mail templates. Recommendations For GigaCC OFFICE versions 2.3 and earlier, update to a version later...

Cacti graph_templates_inputs.php file SQL injection vulnerability

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool through snmpget to get the data , using RRDtool drawing graphs to analyze , and provide data and user management features . An SQL injection vulnerability exists in the graphtemplatesinputs.p...

CVE-2017-1000031

SQL injection vulnerability in graphtemplatesinputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the graphtemplateinputid and graphtemplateid parameters...

UBUNTU-CVE-2017-1000031

SQL injection vulnerability in graphtemplatesinputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the graphtemplateinputid and graphtemplateid parameters...