Fiyo CMS SQL Injection Vulnerability (CNVD-2017-23897)

Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the dapur/apps/appcomment/controller/commentstatus.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit the vulnerability to execute arbitrary SQL commands with the help of...

Fiyo CMS SQL Injection Vulnerability (CNVD-2017-23895)

Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the dapur/apps/appcomment/syscomment.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit the vulnerability with $POST'comment', $POST'name', $POST'web', $POST'email',...

Piwigo SQL Injection Vulnerability

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time and more. A SQL injection vulnerability exists in the administrative backend of Piwigo 2.9.1 and previous versions. A remote attack...

SQL Injection Vulnerability in appcms comment.php

APPCMS is a professional APP content management system. APPCMS comment.php suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to obtain sensitive database information or perform unauthorized operations...

The FAA Is Arguing for Security by Obscurity

In a proposed rule by the FAA, it argues that software in an Embraer S.A. Model ERJ 190-300 airplane is secure because it's proprietary: In addition, the operating systems for current airplane systems are usually and historically proprietary. Therefore, they are not as susceptible to corruption...

CVE-2017-9505

Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments add...

Multiple Open Redirect Vulnerabilities

Moodle is vulnerable to multiple open redirect vulnerabilities. The vulnerabilities exist because of insufficient filtering of return URLs on some pages, leading to redirection to other arbitrary sites. It can also result in phishing attacks through 1 backup/backupfilesedit.php, 2...

XXE Vulnerability in Various TRS Products

WCM, Portal, infogate plug-ins, comment plug-ins, etc. developed by Topsy, widely used in the national government, enterprises and institutions portal system and plug-ins. TRS a variety of products mainly including: WCM, Portal, infogate plug-ins, comment plug-ins exist XXE entity injection...

INFOR EAM 11.0 Build 201410 - Persistent Cross-Site Scripting via Comment Fields

Stored XSS in INFOR EAM V11.0 Build 201410 via comment fields ------------------- Assigned CVE: CVE-2017-7953 Reproduction steps: ------------------- 1. Log in with your EAM account 2. Go to the jobs page 3. Click on a record and open its page 4. Go to "Comments" tab 4. Click the add new comment...

INFOR EAM 11.0 Build 201410 - Persistent Cross-Site Scripting via Comment Fields

INFOR EAM 11.0 Build 201410 - Persistent Cross-Site Scripting via Comment Fields Stored XSS in INFOR EAM V11.0 Build 201410 via comment fields ------------------- Assigned CVE: CVE-2017-7953 Reproduction steps: ------------------- 1. Log in with your EAM account 2. Go to the jobs page 3. Click on...

INFOR EAM 11.0 Build 201410 - Persistent Cross-Site Scripting via Comment Fields Vulnerability

Exploit for multiple platform in category web applications Stored XSS in INFOR EAM V11.0 Build 201410 via comment fields ------------------- Assigned CVE: CVE-2017-7953 Reproduction steps: ------------------- 1. Log in with your EAM account 2. Go to the jobs page 3. Click on a record and open its...

Design/Logic Flaw

INFOR EAM V11.0 Build 201410 has XSS via comment fields...

CVE-2017-7953

INFOR EAM V11.0 Build 201410 has XSS via comment fields...

CVE-2017-7953

INFOR EAM V11.0 Build 201410 has XSS via comment fields...

PT-2017-4258 · Gnome +5 · Libcroco +5

Name of the Vulnerable Software and Affected Versions: libcroco version 0.6.12 Description: The issue is related to the cr tknzr parse comment function in the cr-tknzr.c component of the libcroco library, which can cause a denial of service due to a memory allocation error when processing a craft...

XXE Vulnerability in TRS Comment Plugin

TRS Comment plug-in developed by Topsy, widely used in the national government, enterprises and institutions portal of the general-purpose plug-ins. TRS Comment plug-in synchannel Servlet XXE vulnerability, an attacker can use the vulnerability to read any file on the server, traversing the serve...

CVE-2017-8780

GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element...

Code injection

GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element...

CVE-2017-8780

GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element...

CVE-2017-8780

GeniXCMS 1.0.2 is affected by a cross-site scripting (XSS) vulnerability triggered by a comment mishandled during an administrator publish operation, demonstrated by a malformed P element. Root cause and impact are described across multiple sources (NVD/NVD, Red Hat, GHSA, OSV, CNVD, CNVD). The d...