6728 matches found
PT-2019-7842
Name of the Vulnerable Software and Affected Versions OpenStack Magnum affected versions not specified Description The issue allows full API access, enabling any API operation the user is authorized to perform, as OpenStack Magnum passes OpenStack credentials into the Heat templates creating its...
CVE-2017-2116
Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors...
CVE-2017-2116
Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors...
Authentication flaw
Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors...
CVE-2017-2116
Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors...
CVE-2017-2116
Cybozu Office 10.0.0–10.5.0 contains an access restriction bypass in the templates delete function for the ustomapp eature, enabling remote authenticated attackers to delete ustomapp mplates via unspecified vectors. The CVE is CVE-2017-2116. The vulnerability is documented across multiple sourc...
PT-2017-15183
Name of the Vulnerable Software and Affected Versions Cybozu Office versions 10.0.0 through 10.5.0 Description The issue allows remote authenticated attackers to bypass access restrictions and delete customapp templates. Recommendations For Cybozu Office versions 10.0.0 through 10.5.0, at the...
CVE-2017-2116: Undefined Security Weakness
Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors...
Trend Micro Control Manager cgiShowClientAdm Security Bypass
The version of Trend Micro Control Manager running on the remote host is affected by a security bypass vulnerability when processing calls to the cgiShowClientAdm web function due to a failure to provide authentication for the functionality that exposes, modifies, or deletes DLP templates involve...
Cybozu Office fails to restrict access permission in the templates delete function in "customapp"
Overview Cybozu Office contains an access restriction flaw in the templates delete function in "customapp". Cybozu, Inc. reported this vulnerabilities to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the Information Security Early Warning...
MODX Revolution 'setup/templates/findcore.php' file remote code execution vulnerability
MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A security vulnerability exists in the setup/templates/findcore.php file in MODX Revolution 2.5.4-pl and...
PT-2017-17668
Name of the Vulnerable Software and Affected Versions MODX Revolution versions 2.5.4-pl and earlier Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the core path parameter in the setup/templates/findcore.php file. Recommendations For MODX Revoluti...
CVE-2017-7324: Improper Control of Generation of Code
setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the corepath parameter...
PYSEC-2017-62
Cross-site scripting XSS vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...
Cross site request forgery (csrf)
Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery CSRF attacks as demonstrated by editing user account information in the templates.asmx.cs file...
Authentication flaw
Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...
PYSEC-2017-57
Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...
CVE-2016-4043
Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...
CVE-2016-4043
Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...
Cross site scripting
IBM Social Rendering Templates for Digital Data Connector is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...