79 matches found
CVE-2017-11716
MetInfo through 5.3.17 allows stored XSS via HTML Edit Mode...
Cross site scripting
MetInfo through 5.3.17 allows stored XSS via HTML Edit Mode...
CVE-2017-11716
MetInfo through 5.3.17 allows stored XSS via HTML Edit Mode...
CVE-2017-11716
MetInfo vulnerable to stored XSS through HTML Edit Mode in versions up to 5.3.17 (CVE-2017-11716). Affected software: MetInfo CMS. Root cause: HTML Edit Mode allows injection of arbitrary scripts; impact includes partial integrity concerns and possible user impersonation in the web UI. No explici...
PT-2017-12196
Name of the Vulnerable Software and Affected Versions MetInfo versions prior to 5.3.18 Description The issue allows for stored XSS via HTML Edit Mode. Recommendations For MetInfo versions prior to 5.3.18, update to version 5.3.18 or later to resolve the issue...
CVE-2017-11716: Improper Neutralization of Input During Web Page Generation
MetInfo through 5.3.17 allows stored XSS via HTML Edit Mode...
Juniper Networks Junos OS Exclusive Edit Mode Privilege Escalation Vulnerability
Privilege Escalation in exclusive edit mode SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:juniper:junos"; if description...
CKEditor < 4.1 Drupal 6.x & 7.x - Persistent XSS Vulnerability
Exploit for php platform in category web applications Exploit Title: Persistent XSS in wysiwyg CKEditor + Disclosure and Fix: This was disclosed to Drupal on 20/01/13, and was fixed with the release of ckeditor 4.1...
Juniper Junos load factory-default Privilege Escalation (PSN-2012-07-646)
According to its self-reported version number, the remote Junos device has a privilege escalation vulnerability. When the 'load factory-default' command fails in exclusive edit mode, the user is no longer subject to any command or configuration restrictions. C Tenable Network Security, Inc...
XSS vulnerability in Office Connector plugin
From: OFFCONN-81: Using "office excel"-macro as part of viewfile, which is part of office connector plugin seems to open up the possibility to get injected with XSS-code. Steps to reproduce: 1. Create an excel-file with following content in one cell: code '"alert'XSS' code 2. Attach this file to ...
PT-2012-3030
Unspecified vulnerability in EPiServer CMS 5 and 6 through 6R2, in certain configurations using Forms Authentication, allows remote authenticated users to obtain WebAdmins access by leveraging Edit Mode privileges, a different vulnerability than CVE-2011-3416 and CVE-2011-3417...
CVE-2012-1031: Undefined Security Weakness
Unspecified vulnerability in EPiServer CMS 5 and 6 through 6R2, in certain configurations using Forms Authentication, allows remote authenticated users to obtain WebAdmins access by leveraging Edit Mode privileges, a different vulnerability than CVE-2011-3416 and CVE-2011-3417...
DEBIAN-CVE-2011-3871
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files...
Code injection
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files...
PT-2011-1171
Name of the Vulnerable Software and Affected Versions Puppet versions 2.7.x prior to 2.7.5 Puppet versions 2.6.x prior to 2.6.11 Puppet version 0.25.x Description The issue allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files due to the use of a predictable...
CVE-2011-3871
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files...
Linux each version of the local root password cracking method-vulnerability warning-the black bar safety net
This time the old met was asked and the various linux versions of the local root password cracking method, I here own and on the network to collect some information, we want to see this article and just used to give the art a little help: A RedHat/CentOS/Fedora system password cracking 1. In the...
RWiki arbitrary Ruby script execution vulnerability
Overview RWiki, one of Wiki clones, contains a vulnerability allowing execution of arbitrary Ruby scripts on its edit mode page. Impact A remote attacker could execute an arbitrary Ruby script on the server where RWiki is installed, with the privilege running RWiki. Solution...