PT-2017-13495

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 7.7.2.3 SugarCRM versions 7.8.x prior to 7.8.2.2 SugarCRM versions 7.9.x prior to 7.9.2.0 Sugar Community Edition version 6.5.26 Description A remote file inclusion issue has been identified in the Connectors module,...

CVE-2017-14509: Improper Input Validation

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 and Sugar Community Edition 6.5.26. A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a...

sugarcrm -- multiple vulnerabilities

sugarcrm developers report: An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 and Sugar Community Edition 6.5.26. Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection,...

IBM WebSphere Application Server 7.0.0.x < 7.0.0.43 / 8.0.0.x < 8.0.0.14 / 8.5.x < 8.5.5.12 / 9.0.0.x < 9.0.0.4 SOAP Connectors DoS

The IBM WebSphere Application Server running on the remote host is version 7.0.0.x prior to 7.0.0.43, 8.0.0.x prior to 8.0.0.14, 8.5.x prior to 8.5.5.12, or 9.0.0.x prior to 9.0.0.4. It is, therefore, affected by an input validation flaw in SOAP connectors that allows a remote user to cause...

CVE-2017-3635

Vulnerability in the MySQL Connectors component of Oracle MySQL subcomponent: Connector/C. Supported versions that are affected are 6.1.10 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors...

Design/Logic Flaw

Vulnerability in the MySQL Connectors component of Oracle MySQL subcomponent: Connector/C. Supported versions that are affected are 6.1.10 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors...

CVE-2017-3635

Vulnerability in the MySQL Connectors component of Oracle MySQL subcomponent: Connector/C. Supported versions that are affected are 6.1.10 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors...

CVE-2017-11744

In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS. A malicious payload sent to connectors/index.php will be triggered by every user, when they visit this module...

CVE-2017-11744

In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS. A malicious payload sent to connectors/index.php will be triggered by every user, when they visit this module...

PT-2017-12219

Name of the Vulnerable Software and Affected Versions MODX Revolution version 2.5.7 Description The issue concerns the System Settings module, where the key and name parameters are susceptible to XSS attacks. When a malicious payload is sent to the "connectors/index.php" endpoint, it will be...

CVE-2017-11744: Improper Neutralization of Input During Web Page Generation

In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS. A malicious payload sent to connectors/index.php will be triggered by every user, when they visit this module...

PT-2017-16055

Name of the Vulnerable Software and Affected Versions MySQL Connectors versions 6.1.10 and earlier MySQL Server versions 5.5.56 and earlier, 5.6.36 and earlier, 5.7.18 and earlier Description A difficult to exploit vulnerability in the MySQL Connectors component of Oracle MySQL allows a low...

ModX CMS Proof Of Concept Shell Upload

c@kali:/src/Napalm2.2/libs$ cat shell-modxcms.py !/usr/bin/env python shell-modxcms.py - upload shell for modx 2.5.6-pl !! we need rwx in modx-webdir to go ;Z 30.05.217 @ code610 blogspot com import requests import re target=rawinput"Hostname " print '+ Preparing tests for ' + strtarget session =...

CVE-2017-9070

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...

Cross site scripting

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...

CVE-2017-9070

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...

CVE-2017-9070

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...

PT-2017-18686

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.5.7 Description The issue allows a user with resource edit permissions to inject an XSS payload into the title of any post via the "connectors/index.php" endpoint, specifically through the pagetitle paramete...

CVE-2017-9070: Improper Neutralization of Input During Web Page Generation

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...

CVE-2017-3590

Vulnerability in the MySQL Connectors component of Oracle MySQL subcomponent: Connector/Python. Supported versions that are affected are 2.1.5 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to...