CVE-2018-14623

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is...

CVE-2018-14623

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is...

CVE-2018-14623

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs...

Cross-Site Scripting in Backend Modal Component

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-007...

Cross-Site Scripting in Backend Modal Component

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-007...

Cross-Site Scripting in Backend Modal Component

Failing to properly encode user input, notifications shown in modal windows in the TYPO3 backend are vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability...

zzzcms v1.5.8 Code Execution Vulnerability in Backend

zzcms is a free website builder developed in asp language. There is a code execution vulnerability in the backend of zzzcms v1.5.8. An attacker can exploit this vulnerability to execute arbitrary code...

Denial of Service in Online Media Asset Handling

Online Media Asset Handling .youtube and .vimeo files in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a...

Weak Password Vulnerability in e5e Website Management System Wangzt 3.0.4 Enterprise Edition

Hunan Fifth Element Network Technology Development Co., Ltd. is a company specializing in Internet information services, enterprise application software development and e-commerce platform construction enterprises. Weak password vulnerability exists in e5e website management system Wangzt3.0.4...

Cross-Site Scripting in Online Media Asset Rendering

Failing to properly encode user input, online media asset rendering .youtube and .vimeo files is vulnerable to cross-site scripting. A valid backend user account or write access on the server system e.g. SFTP is needed in order to exploit this vulnerability...

Cross-Site Scripting in CKEditor

It has been discovered, that the third party library CKEditor is vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability...

typo3 -- multiple vulnerabilities

Typo3 core team reports: CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr. The vulnerability stemmed from the fact that it was possible to execute XSS inside the CKEditor source area after persuading the victim to: i switch CKEditor to source mode, then ii paste a...

CVE-2018-16635

Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php...

CVE-2018-16635

CVE-2018-16635 affects Blackcat CMS 1.3.2 and is an XSS vulnerability exposed via the willkommen.php?lang=DE page title on backend/pages/modify.php. The CVSS metrics indicate a Low (CVSS2: 3.5) to Medium (CVSS3: 5.4) base severity, with network attack vector, low complexity, and user interaction ...

SQL Injection Vulnerability in ESPCMS P8 Backend Me***.php File

ESPCMS is an enterprise website management system built on LAMP development. A SQL injection vulnerability exists in the ESPCMS P8 backend Me.php file. Attackers can use this vulnerability to obtain sensitive information in the database...

BoyiCMS V3.0 Backend Logic Flaw Vulnerability

BoyiCMS is an intelligent building management system developed for hospital websites. A logic flaw vulnerability exists in BoyiCMS V3.0 backend. Attackers can use this vulnerability to obtain sensitive information in the background...

Code execution vulnerability in anmi V1.1.0 backend

Anmi program is a program that focuses on H5 mobile website/app construction. Code execution vulnerability exists in anmi V1.1.0. An attacker can exploit the vulnerability to execute commands and gain server privileges...

CVE-2018-1002105

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary reques...

UBUNTU-CVE-2018-1002105

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary reques...

CVE-2018-1002105

CVE-2018-1002105 affects Kubernetes: before versions v1.10.11, v1.11.5, and v1.12.3, the kube-apiserver mishandles error responses to proxied upgrade requests. This flaw lets specially crafted requests establish a connection through the API server to backends and then send arbitrary requests over...