ThinkCMF Arbitrary File Deletion Vulnerability

ThinkCMF is a CMS Content Management System based on ThinkPHP. An arbitrary file deletion vulnerability exists in the 'doavatar' function in the \application\User\Controller\ProfileController.class.php file in ThinkCMF version X2.2.3. An attacker can delete arbitrary files with the help of the...

CVE-2018-16366

An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF...

CVE-2018-16332

An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability...

PT-2018-13495

Name of the Vulnerable Software and Affected Versions iCMS version 7.0.9 Description An issue was discovered in the software, which is related to a CSRF vulnerability in the admincp.php endpoint, specifically when app=article and do=update. Recommendations For iCMS version 7.0.9, consider...

PT-2018-13521

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.10 Description An issue was discovered that allows Cross-Site Request Forgery CSRF attacks. The "admincp.php?app=user&do=save" endpoint is vulnerable to this issue. Recommendations For idreamsoft iCMS version 7.0.10...

PT-2018-13520

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.10 Description An issue was discovered that allows Cross-Site Request Forgery CSRF attacks. The "admincp.php?app=group&do=save" endpoint is vulnerable to this issue. Recommendations For idreamsoft iCMS version 7.0.1...

CVE-2018-16365: Cross-Site Request Forgery (CSRF)

An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=group&do=save allows CSRF...

CVE-2018-16332: Cross-Site Request Forgery (CSRF)

An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability...

PT-2018-13420

Name of the Vulnerable Software and Affected Versions ThinkCMF version X2.2.3 Description The issue allows for arbitrary file deletion. It is located in the do avatar function within the ProfileController.class.php file. The vulnerability can be exploited via the imgurl parameter by using a...

Detect Evil Maid Attacks: Do Not Disturb

Physical access or “evil maid” attacks are some of the most insidious threats faced by those of us who travel with our Macs. Do Not Disturb DND is a free, open-source utility that aims to detect and alert you of such attacks! One of the best ways to compromise a computer is with physical access...

FreeBSD : PostgreSQL -- two vulnerabilities (96eab874-9c79-11e8-b34b-6cc21735f730)

The PostgreSQL project reports : CVE-2018-10915: Certain host connection parameters defeat client-side security defenses libpq, the client connection API for PostgreSQL that is also used by other connection libraries, had an internal issue where it did not reset all of its connection state...

CVE-2018-10925

It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server...

PT-2018-2663

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 10.5 PostgreSQL versions prior to 9.6.10 PostgreSQL versions prior to 9.5.14 PostgreSQL versions prior to 9.4.19 PostgreSQL versions prior to 9.3.24 Description The issue is related to errors in authorization withi...

CVE-2018-10925: Incorrect Authorization

It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server...

CVE-2018-15169

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the /deleteMO.do method parameter...

CVE-2018-15130

CVE-2018-15130 affects ThinkSAAS up to 2018-07-25. The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable via the parameter groupdesc in the URL path index.php?app=group&ac=create&ts=do, allowing injection of arbitrary web script/HTML into the page. Root cause details beyond XSS are n...

PT-2018-12888

Name of the Vulnerable Software and Affected Versions ThinkSAAS versions prior to 2018-07-25 Description The issue allows for XSS via the index.php?app=group&ac=create&ts=do endpoint, specifically through the groupdesc parameter. Recommendations For versions prior to 2018-07-25, avoid using the...

PT-2018-12886

Name of the Vulnerable Software and Affected Versions ThinkSAAS versions prior to 2018-07-25 Description The issue allows for XSS via the content parameter in the "index.php?app=article&ac=comment&ts=do" endpoint. Recommendations For versions prior to 2018-07-25, update to a version released afte...

CVE-2018-15129: Improper Neutralization of Input During Web Page Generation

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter...

PT-2018-12841

Name of the Vulnerable Software and Affected Versions EMLsoft version 5.4.5 Description A security issue was found in the software, where a Cross-Site Scripting XSS attack can be performed. This issue is related to the "eml/upload/eml/?action=address&do=edit" page, which is an API endpoint...