CVE-2017-2116: Undefined Security Weakness

Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors...

PT-2017-15183

Name of the Vulnerable Software and Affected Versions Cybozu Office versions 10.0.0 through 10.5.0 Description The issue allows remote authenticated attackers to bypass access restrictions and delete customapp templates. Recommendations For Cybozu Office versions 10.0.0 through 10.5.0, at the...

Trend Micro Control Manager cgiShowClientAdm Security Bypass

The version of Trend Micro Control Manager running on the remote host is affected by a security bypass vulnerability when processing calls to the cgiShowClientAdm web function due to a failure to provide authentication for the functionality that exposes, modifies, or deletes DLP templates involve...

Cybozu Office fails to restrict access permission in the templates delete function in "customapp"

Overview Cybozu Office contains an access restriction flaw in the templates delete function in "customapp". Cybozu, Inc. reported this vulnerabilities to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the Information Security Early Warning...

MODX Revolution 'setup/templates/findcore.php' file remote code execution vulnerability

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A security vulnerability exists in the setup/templates/findcore.php file in MODX Revolution 2.5.4-pl and...

CVE-2017-7324: Improper Control of Generation of Code

setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the corepath parameter...

PT-2017-17668

Name of the Vulnerable Software and Affected Versions MODX Revolution versions 2.5.4-pl and earlier Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the core path parameter in the setup/templates/findcore.php file. Recommendations For MODX Revoluti...

PYSEC-2017-62

Cross-site scripting XSS vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

Cross site request forgery (csrf)

Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery CSRF attacks as demonstrated by editing user account information in the templates.asmx.cs file...

Authentication flaw

Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...

PYSEC-2017-57

Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...

CVE-2016-4043

Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...

CVE-2016-4043

Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...

Cross site scripting

IBM Social Rendering Templates for Digital Data Connector is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2016-8936

The CVE-2016-8936 entry concerns IBM Social Rendering Templates for Digital Data Connector. Available connected sources confirm a Cross-Site Scripting (XSS) vulnerability in the Web UI, which could allow an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trust...

Faraday v2.3 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday is the Integrated Multiuser Risk Environment you were looking for! It maps and leverages all the knowledge you generate in real time, letting you track and understand your audits. Our dashboard for CISOs and managers uncovers the impact and risk being assessed by the audit in real-time...

CVE-2016-8936: Improper Neutralization of Input During Web Page Generation

IBM Social Rendering Templates for Digital Data Connector is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2017-9882

Name of the Vulnerable Software and Affected Versions IBM Social Rendering Templates for Digital Data Connector affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to...

CVE-2016-9410

MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates...

PT-2017-10126

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.7 MyBB Merge System versions prior to 1.8.7 Description The issue might allow remote attackers to obtain sensitive database information via vectors involving templates. Recommendations For MyBB versions prior to 1.8....