PT-2017-11994

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue concerns SQL injection. It can be exploited via the $ GET'id' variable in the dapur/apps/app comment/controller/comment status.php file. Recommendations For Fiyo CMS version 2.0.7, consider...

Fiyo CMS SQL Injection Vulnerability (CNVD-2017-23895)

Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the dapur/apps/appcomment/syscomment.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit the vulnerability with $POST'comment', $POST'name', $POST'web', $POST'email',...

PT-2017-11998

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue concerns SQL injection. It can be exploited via the name parameter in the /apps/app comment/controller/insert.php API endpoint. Recommendations For Fiyo CMS version 2.0.7, avoid using the name...

PT-2017-11996

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue concerns SQL injection in a specific PHP file, allowing potential exploitation via several parameters. The vulnerable parameters include comment, name, web, email, status, id from $ POST, and id fro...

Piwigo SQL Injection Vulnerability

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time and more. A SQL injection vulnerability exists in the administrative backend of Piwigo 2.9.1 and previous versions. A remote attack...

SQL Injection Vulnerability in appcms comment.php

APPCMS is a professional APP content management system. APPCMS comment.php suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to obtain sensitive database information or perform unauthorized operations...

The FAA Is Arguing for Security by Obscurity

In a proposed rule by the FAA, it argues that software in an Embraer S.A. Model ERJ 190-300 airplane is secure because it's proprietary: In addition, the operating systems for current airplane systems are usually and historically proprietary. Therefore, they are not as susceptible to corruption...

CVE-2017-9505

Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments add...

Multiple Open Redirect Vulnerabilities

Moodle is vulnerable to multiple open redirect vulnerabilities. The vulnerabilities exist because of insufficient filtering of return URLs on some pages, leading to redirection to other arbitrary sites. It can also result in phishing attacks through 1 backup/backupfilesedit.php, 2...

XXE Vulnerability in Various TRS Products

WCM, Portal, infogate plug-ins, comment plug-ins, etc. developed by Topsy, widely used in the national government, enterprises and institutions portal system and plug-ins. TRS a variety of products mainly including: WCM, Portal, infogate plug-ins, comment plug-ins exist XXE entity injection...

INFOR EAM 11.0 Build 201410 - Persistent Cross-Site Scripting via Comment Fields Vulnerability

Exploit for multiple platform in category web applications Stored XSS in INFOR EAM V11.0 Build 201410 via comment fields ------------------- Assigned CVE: CVE-2017-7953 Reproduction steps: ------------------- 1. Log in with your EAM account 2. Go to the jobs page 3. Click on a record and open its...

INFOR EAM 11.0 Build 201410 - Persistent Cross-Site Scripting via Comment Fields

INFOR EAM 11.0 Build 201410 - Persistent Cross-Site Scripting via Comment Fields Stored XSS in INFOR EAM V11.0 Build 201410 via comment fields ------------------- Assigned CVE: CVE-2017-7953 Reproduction steps: ------------------- 1. Log in with your EAM account 2. Go to the jobs page 3. Click on...

INFOR EAM 11.0 Build 201410 - Persistent Cross-Site Scripting via Comment Fields

Stored XSS in INFOR EAM V11.0 Build 201410 via comment fields ------------------- Assigned CVE: CVE-2017-7953 Reproduction steps: ------------------- 1. Log in with your EAM account 2. Go to the jobs page 3. Click on a record and open its page 4. Go to "Comments" tab 4. Click the add new comment...

CVE-2017-7953

INFOR EAM V11.0 Build 201410 has XSS via comment fields...

Design/Logic Flaw

INFOR EAM V11.0 Build 201410 has XSS via comment fields...

CVE-2017-7953

INFOR EAM V11.0 Build 201410 has XSS via comment fields...

CVE-2017-7953: Improper Neutralization of Input During Web Page Generation

INFOR EAM V11.0 Build 201410 has XSS via comment fields...

PT-2017-18025

Name of the Vulnerable Software and Affected Versions INFOR EAM version 11.0 Build 201410 Description The issue is related to a security problem where an attacker can inject malicious code via comment fields, potentially leading to unauthorized actions on the affected system. Recommendations For...

PT-2017-4258 · Gnome +5 · Libcroco +5

Name of the Vulnerable Software and Affected Versions: libcroco version 0.6.12 Description: The issue is related to the cr tknzr parse comment function in the cr-tknzr.c component of the libcroco library, which can cause a denial of service due to a memory allocation error when processing a craft...

XXE Vulnerability in TRS Comment Plugin

TRS Comment plug-in developed by Topsy, widely used in the national government, enterprises and institutions portal of the general-purpose plug-ins. TRS Comment plug-in synchannel Servlet XXE vulnerability, an attacker can use the vulnerability to read any file on the server, traversing the serve...