DEBIAN-CVE-2017-15570

In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/list.html.erb via crafted column data...

CVE-2017-13674

Symantec ProxyClient 3.4 for Windows is susceptible to a privilege escalation vulnerability. A malicious local Windows user can, under certain circumstances, exploit this vulnerability to escalate their privileges on the system and execute arbitrary code with LocalSystem privileges...

CVE-2017-2285

Cross-site scripting vulnerability in Simple Custom CSS and JS prior to version 3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

JVN#31459091: WordPress plugin "Simple Custom CSS and JS" vulnerable to cross-site scripting

The WordPress plugin "Simple Custom CSS and JS" provided by SilkyPress contains a reflected cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on a logged in user's web browser. Solution Update the plugin Update the plugin according to the information provided b...

CVE-2017-1371

Builder tools running in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated user to execute Builder tool actions they do not have access to. IBM X-Force ID: 126864...

Design/Logic Flaw

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ...

CVE-2017-4967

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ...

CVE-2017-4967

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ...

apt-cacher and apt-cacher-ng HTTP Response Splitting Vulnerability

apt-cacher is a set of software used to cache debian packages. apt-cacher-ng is an HTTP protocol proxy for Linux systems. An HTTP response splitting vulnerability exists in versions of apt-cacher before 1.7.15 and apt-cacher-ng before 3.4. An attacker can exploit this vulnerability to inject HTTP...

CentOS Update for squid34 CESA-2017:0183 centos6

Check the version of squid34 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882646";...

CodoForum 3.2.1 - SQL Injection

CodoForum 3.2.1 - SQL Injection 1. Advisory Information ======================================== Title : CodoForum = 3.2.1 Remote SQL Injection Vulnerability Vendor Homepage : https://codoforum.com/ Remotely Exploitable : Yes Versions Affected : Prior to 3.2.1 Tested on : Ubuntu Apache | PHP 5.5....

Design/Logic Flaw

model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records...

Joomla! directory traversal vulnerability (CNVD-2015-08378)

Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. The system provides RSS feeds , site search and other functions . A directory traversal vulnerability exists in Joomla! versions 3.4.x before 3.4.6. A remote attacker can exploit th...

Joomla! cross-site request forgery vulnerability (CNVD-2015-08379)

Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. The system provides RSS feeds , site search and other functions . A cross-site request forgery vulnerability exists in the comtemplates component in Joomla! versions 3.2.0 through...

Cross-Site Scripting Vulnerability in Joomla!

Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. login is one of the login module . A cross-site scripting vulnerability exists in the login module in Joomla! versions 3.4.4 and 3.4.x prior to Joomla! A remote attacker can exploit...

CodoForum 3.3.1 - Multiple SQL Injection Vulnerabilities

Exploit for php platform in category web applications CodoForum 3.3.1: Multiple SQL Injection Vulnerabilities Security Advisory – Curesec Research Team http://blog.curesec.com/article/blog/CodoForum-331-Multiple-SQL-Injection-Vulnerabilities-42.html 1. Introduction Affected Product: CodoForum 3.3...

CodoForum 3.3.1 - Multiple SQL Injections

CodoForum 3.3.1: Multiple SQL Injection Vulnerabilities Security Advisory – Curesec Research Team http://blog.curesec.com/article/blog/CodoForum-331-Multiple-SQL-Injection-Vulnerabilities-42.html 1. Introduction Affected Product: CodoForum 3.3.1 Fixed in: 3.4 Fixed Version Link:...

CodoForum 3.3.1 - Multiple SQL Injections

CodoForum 3.3.1 - Multiple SQL Injections CodoForum 3.3.1: Multiple SQL Injection Vulnerabilities Security Advisory – Curesec Research Team http://blog.curesec.com/article/blog/CodoForum-331-Multiple-SQL-Injection-Vulnerabilities-42.html 1. Introduction Affected Product: CodoForum 3.3.1 Fixed in:...

CodoForum 3.3.1 SQL Injection

CodoForum 3.3.1: Multiple SQL Injection Vulnerabilities Security Advisory – Curesec Research Team http://blog.curesec.com/article/blog/CodoForum-331-Multiple-SQL-Injection-Vulnerabilities-42.html 1. Introduction Affected Product: CodoForum 3.3.1 Fixed in: 3.4 Fixed Version Link:...

Cross-Site Request Forgery Vulnerability in Joomla!

Joomla! is an open source content management system CMS. A cross-site request forgery vulnerability exists in Joomla! versions 3.2.0 through 3.3.x, and 3.4.x before 3.4.2, which allows remote attackers to hijack requests to upload code via unknown vectors...