phpCollab SQL Injection Vulnerability

phpCollab is an open source Internet enablement system for projects that require collaboration over the Internet. A SQL injection vulnerability exists in phpCollab 2.5.1 and earlier versions. The vulnerability can be exploited by remote attackers to execute arbitrary SQL commands via the id...

Cross-site Scripting (XSS)

genix/cms is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the id field in /inc/lib/backend/menus.control.php, allowing a malicious user to inject and execute arbitrary web script...

Immunity Canvas: EMACS_ENRICHED

Name| emacsenriched ---|--- CVE| CVE-2017-14482 Exploit Pack| CANVAS Description| Emacs Enriched Mime-type Handler Arbitrary ELISP Execution Notes| CVE Name: CVE-2017-14482 VENDOR: https://www.gnu.org/software/emacs/ Notes: Either email this to someone using the GNUS email client or convince them...

Concrete5 SQL Injection Vulnerability (CNVD-2017-32457)

concrete5 is a free content management system CMS. The system can be edited and typeset directly on the page. A SQL injection vulnerability exists in concrete5 version 5.7.3.1, which originates when the program fails to properly validate user input before using SQL query statements. A remote...

CVE-2017-10844

baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors...

Code injection

baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors...

[ASA-201708-18] thunderbird: multiple issues

Arch Linux Security Advisory ASA-201708-18 ========================================== Severity: Critical Date : 2017-08-23 CVE-ID : CVE-2017-7753 CVE-2017-7779 CVE-2017-7784 CVE-2017-7785 CVE-2017-7786 CVE-2017-7787 CVE-2017-7791 CVE-2017-7792 CVE-2017-7800 CVE-2017-7801 CVE-2017-7802 CVE-2017-78...

NexusPHP SQL Injection Vulnerability

NexusPHP is a resource sharing community solution written in PHP developed by the Nexus team in China. SQL injection vulnerability in the massmail.php file in NexusPHP version 1.5. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...

Synology Office Command Injection Vulnerability

Synology Office is a web-based office software system from Synology. The system features online document and spreadsheet creation, as well as importing local files. A command injection vulnerability exists in the Document.php file in Synology Office versions 2.2.0-1502 and 2.2.1-1506. A remote...

UBUNTU-CVE-2017-9800

A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server to attack another...

Cross site scripting

services/systemio/actionprocessor/Contact.rails in ConnectWise Manage 2017.5 allows arbitrary client-side JavaScript code execution involving a ContactCommon field on victims who click on a crafted link, aka XSS...

Cross-site Scripting (XSS)

Bolt CMS is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the user input, allowing a malicious user to inject and execute arbitrary javascript through the Title Field of a new entry...

Code injection

Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading functions in the installer plugin. A successful exploitation could lead to arbitrary code execution...

Inflection: XSS at https://app.goodhire.com/member/GH.aspx

Unescaped input from a URL parameter in the checkout flow was being used as a JavaScript variable for determining what cart contents to render. By manipulating the URL parameter, the researcher was able to execute arbitrary JavaScript on the page...

CVE-2017-8768

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID...

Directory traversal

Tablacus Explorer 17.3.30 and earlier allows arbitrary scripts to be executed in the context of the application due to specially crafted directory...

CVE-2017-2141

The CVE-2017-2141 entry concerns the WN-G300R3 router from I-O DATA DEVICE. Affects firmware version 1.03 and earlier. The vulnerability is an OS command injection (CWE-78) that can be exploited by an authenticated attacker with administrator rights to execute arbitrary OS commands on the product...

Mercurial Custom hg-ssh Wrapper Remote Code Exec

This module takes advantage of custom hg-ssh wrapper implementations that don't adequately validate parameters passed to the hg binary, allowing users to trigger a Python Debugger session, which allows arbitrary Python code execution. This module requires Metasploit: https://metasploit.com/downlo...

Satel Iberia SenNet Data Logger and Electricity Meters Command Injection Vulnerability

This module exploits an OS Command Injection vulnerability in Satel Iberia SenNet Data Loggers & Electricity Meters to perform arbitrary command execution as 'root'. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework cla...

CVE-2017-7390

A Cross-Site Scripting XSS was discovered in 'SocialNetwork v1.2.1'. The vulnerability exists due to insufficient filtration of user-supplied data mail passed to the 'SocialNetwork-andrea/app/template/pwforgot.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the...