CVE-2018-5376

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecpupload.php op parameter...

mybb -- multiple vulnerabilities

myBB Team reports: High risk: Installer RCE on configuration file write High risk: Language file headers RCE Medium risk: Installer XSS Medium risk: Mod CP Edit Profile XSS Low risk: Insufficient moderator permission check in delayed moderation tools Low risk: Announcements HTML filter bypass Low...

Cross site request forgery (csrf)

The cp-contact-form-with-paypal aka CP Contact Form with PayPal plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cpcontactformpp.php and cpcontactformppadminintlist.inc.php...

CVE-2015-9234

The cp-contact-form-with-paypal aka CP Contact Form with PayPal plugin before 1.1.6 for WordPress has SQL injection via the cpcontactformppid parameter to cpcontactformpp.php...

CVE-2015-9233

The CP Contact Form with PayPal WordPress plugin (pre-1.1.6) is affected by a CSRF vulnerability that can lead to Cross-Site Scripting (XSS), related to cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php. Affected versions are prior to 1.1.6; updating to 1.1.6 or later is the docume...

CVE-2015-9234

The cp-contact-form-with-paypal aka CP Contact Form with PayPal plugin before 1.1.6 for WordPress has SQL injection via the cpcontactformppid parameter to cpcontactformpp.php...

CVE-2017-12856

Cross-site scripting XSS vulnerability in C.P.Sub 5.2 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter to index.php...

CVE-2017-6868

An Improper Authentication issue was discovered in Siemens SIMATIC CP 44x-1 RNA, all versions prior to 1.4.1. An unauthenticated remote attacker may be able to perform administrative actions on the Communication Process CP of the RNA series module, if network access to Port 102/TCP is available a...

Authentication flaw

An Improper Authentication issue was discovered in Siemens SIMATIC CP 44x-1 RNA, all versions prior to 1.4.1. An unauthenticated remote attacker may be able to perform administrative actions on the Communication Process CP of the RNA series module, if network access to Port 102/TCP is available a...

CVE-2017-6868

An Improper Authentication issue was discovered in Siemens SIMATIC CP 44x-1 RNA, all versions prior to 1.4.1. An unauthenticated remote attacker may be able to perform administrative actions on the Communication Process CP of the RNA series module, if network access to Port 102/TCP is available a...

Siemens Patches Two Vulnerabilities in SIMATIC CP and XHQ

Siemens patched two vulnerabilities in products commonly found in industrial control system setups this week. If exploited the flaws could allow an attacker to perform administrative actions or gain read access to sensitive data on affected systems. Siemens patched one issue .PDF on Tuesday and t...

Siemens SIMATIC CP 44x-1 Redundant Network Access Modules

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: SIMATIC CP 44x-1 Redundant Network Access RNA modules Vulnerability: Improper Authentication AFFECTED PRODUCTS The following versions of the SIMATIC CP 44x-1 RNA, which connect SIMATIC S7-400 CPUs t...

Invision Power Board 4.1.19.2 XSS / CSRF / File Upload / Information Disclosure

Description: Invision Power Board version 4.1.19.2 current version as of this release and below, is vulnerable to pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18 and stored XSS in the Announcements. The vulnerability in the IPS UTF8 Converter can easily be used to make a malicious...

Trend Micro InterScan Web Security Virtual Appliance 6.5 Multiple Vulnerabilities

Trend Micro has released a new hot fix for Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5. This build resolves multiple vulnerabilities related to potential remote code execution RCE. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the 1 S44, 2 S5, 3 Sactionfail, 4 Sptnupdate, 5 T113, 6 T114, 7 T115, 8 T117117, 9 T118, 10 Tactionfail, 11 Tptnupdate, 12...

CVE-2017-9033

Cross-site request forgery CSRF vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication of users for requests to start an update from an arbitrary source via a crafted request to SProtectLinux/scanoptionset.cgi, related to the...

CVE-2017-9037

Multiple cross-site scripting XSS vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the 1 S44, 2 S5, 3 Sactionfail, 4 Sptnupdate, 5 T113, 6 T114, 7 T115, 8 T117117, 9 T118, 10 Tactionfail, 11 Tptnupdate, 12...

CVE-2017-9032

CVE-2017-9032 affects Trend Micro ServerProtect for Linux 3.0 prior to CP 1531. The vulnerability is a cross-site scripting flaw in the web interface’s log_management.cgi, where the T1 and tmLastConfigFileModifiedDate parameters can be abused to inject arbitrary script/HTML. Evidence in connected...

CVE-2017-9037

CVE-2017-9037 affects Trend Micro ServerProtect for Linux 3.0 prior to CP 1531. The advisory/related reports document cross-site scripting vulnerabilities in notification.cgi and related CGI scripts, enabling an attacker to inject arbitrary script/HTML via parameters such as S44, S5, S_action_fai...

CVE-2017-8899

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can be used to gain access to moderator/admin accounts. The...