Brilliant Gallery - Highly critical - Multiple Vulnerabilities - SA-CONTRIB-2017-079

This module enables you to display any number of galleries based on images located in the files folder. The module doesn't sufficiently sanitize various database queries which may allow attackers to craft requests resulting in an SQL injection vulnerability. This vulnerability could be exploited...

Axis SSI - Remote Command Execution Read Files

Axis SSI - Remote Command Execution Read Files STX Subject: SSI Remote Execute and Read Files Researcher: bashis August 2016 Release date: October, 2017 Old stuff that I've forgotten, fixed Q3/2016 by Axis Attack Vector: Remote Authentication: Anonymous no credentials needed Conditions: The cam...

CVE-2017-5635

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user...

PT-2017-16635

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 0.7.2 Apache NiFi versions 1.x prior to 1.1.2 Description The issue arises in a cluster environment when an anonymous user request is replicated to another node. Instead of using the "anonymous" user identity, the...

CVE-2017-5635: Improper Authentication

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user...

Contributors Summary Macro Shows Data to Anonymous Users

h2. Steps to reproduce In Global Permission, ensure Anonymous users "Can Use" Confluence Create new Space , eg: SpaceA Go To Space Tools Permissions Edit Permission Ensure Anonymous Users has "View" Permission Create a few test pages in SpaceA Then, create a page containing both Contributors Macr...

Contributors Summary Macro Shows Data to Anonymous Users

h2. Steps to reproduce In Global Permission, ensure Anonymous users "Can Use" Confluence Create new Space , eg: SpaceA Go To Space Tools Permissions Edit Permission Ensure Anonymous Users has "View" Permission Create a few test pages in SpaceA Then, create a page containing both Contributors Macr...

Windows SMB Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the default Windows SMB Server configuration which allows anonymous users to remotely access certain named pipes that are also configured to allow anonymous access to users who are logged on locally. An unauthenticated attacker who successfully...

CVE-2017-1483

IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 128621...

CVE-2017-1483

IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 128621...

Authentication flaw

IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 128621...

Moodle cross-site scripting vulnerability (CNVD-2017-27611)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A cross-site scripting vulnerability exists in the contact form on the 'non-respondent...

CVE-2017-12156

Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback...

CVE-2017-12156

Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback...

UBUNTU-CVE-2017-12156

Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback...

Design/Logic Flaw

Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback...

CVE-2017-12156

CVE-2017-12156 affects Moodle 3.x, with an XSS in the contact form on the non-respondents page of non-anonymous feedback. The vulnerability enables script injection (confidentiality/integrity impact listed as low) with user interaction required and network access. Public details show Fedora advis...

PT-2017-12371

Name of the Vulnerable Software and Affected Versions Moodle versions 3.x Description The issue is related to a cross-site scripting XSS flaw in the contact form on the "non-respondents" page in non-anonymous feedback. Recommendations For Moodle versions 3.x, update to a version that includes a f...

CVE-2017-12156: Improper Neutralization of Input During Web Page Generation

Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback...

The vulnerability of the management subsystem for publicly accessible anonymous memory in the Android operating system from the CAF repository allows a hacker to trigger a kernel crash and execute arbitrary code.

The vulnerability of the management subsystem for publicly accessible anonymous memory in the Android operating system, originating from the CAF repository, is related to improper data processing when working with virtual memory in user space, which is only accessible for reading purposes...