CVE-2017-15571

CVE-2017-15571 affects Redmine prior to 3.2.8, 3.3.x prior to 3.3.5, and 3.4.x prior to 3.4.3. The vulnerability is a cross-site scripting (XSS) flaw in app/views/issues/_list.html.erb caused by crafted column data, enabling injection of HTML/script in affected deployments. Connected sources conf...

CVE-2017-15571

In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/list.html.erb via crafted column data...

CVE-2017-15570

In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/list.html.erb via crafted column data...

CVE-2017-15571: Improper Neutralization of Input During Web Page Generation

In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/list.html.erb via crafted column data...

CVE-2017-15570: Improper Neutralization of Input During Web Page Generation

In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/list.html.erb via crafted column data...

PT-2017-14102

Name of the Vulnerable Software and Affected Versions Redmine versions prior to 3.2.8 Redmine versions 3.3.x prior to 3.3.5 Redmine versions 3.4.x prior to 3.4.3 Description The issue exists in the app/views/timelog/ list.html.erb file via crafted column data, allowing for XSS. Recommendations Fo...

PT-2017-14103

Name of the Vulnerable Software and Affected Versions Redmine versions prior to 3.2.8 Redmine versions 3.3.x prior to 3.3.5 Redmine versions 3.4.x prior to 3.4.3 Description A security issue exists in the app/views/issues/ list.html.erb file of Redmine, where crafted column data can lead to XSS...

ALPINE-CVE-2017-15286

SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where sqlite3steppStmt==SQLITEROW is false and a data structure is never initialized...

Design/Logic Flaw

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of another user...

CVE-2017-15196

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of another user...

Encryption: Pros and Cons

The expression “when you are a hammer, everything is a nail” has a curious background. The concept belongs to a generalized law of the instrument which is a cognitive bias that occurs by being overly familiar with certain tools, and the likelihood of force-fitting problems to the tools at hand. A...

CVE-2017-1000005

PHPMiniAdmin version 1.9.160630 is vulnerable to stored XSS in the name of databases, tables and columns resulting in potential account takeover and scraping of data stealing data...

CVE-2017-1000005: Improper Neutralization of Input During Web Page Generation

PHPMiniAdmin version 1.9.160630 is vulnerable to stored XSS in the name of databases, tables and columns resulting in potential account takeover and scraping of data stealing data...

PHPMiniAdmin Stored Cross-Site Scripting Vulnerability

PHPMiniAdmin is a lightweight MySQL database management tool written in PHP. The tool supports common functions such as importing and exporting databases and executing SQL statements. A cross-site scripting vulnerability exists in database names, table names, and column names in PHPMiniAdmin...

CVE-2017-1000005

PHPMiniAdmin version 1.9.160630 is vulnerable to stored XSS in the name of databases, tables and columns resulting in potential account takeover and scraping of data stealing data...

XYCMS column management module pid parameters have sql injection vulnerability

XYCMS, formerly known as Nanjing XYCMS Enterprise Station Building System, is a station building platform that provides one-stop web solutions for Chinese enterprises. XYCMS PHP version 1.4 version of the column management module there is a sql injection vulnerability, due to the pid parameter...

HP Vertica Analytics Platform Remote Privilege Vulnerability

Vertica is a column-based storage MPP massively parallel processing architecture of the database. It can support the storage of up to PB Petabyte level of structured data. A remote privilege extraction vulnerability exists in HP Vertica Analytics Platform 4.1 and later versions, which can be...

CVE-2017-6878

Cross-site scripting XSS vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the name2 parameter to admin/column/delete.php...

CVE-2017-6878: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the name2 parameter to admin/column/delete.php...

PT-2017-17391

Name of the Vulnerable Software and Affected Versions MetInfo version 5.3.15 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via the name 2 parameter to "admin/column/delete.php" API endpoint. Recommendations For MetInfo versio...