Arbitrary File Editing Vulnerability in UCMS Version 1.2

UCMS is a simple open source content management system. UCMS 1.2 version of the existence of arbitrary file editing vulnerability, the attacker can edit the non-existent script file, directly write a sentence Trojan horse, to obtain control of the web server...

DRUPAL-CONTRIB-2018-008

This module enables you to show referenced entities in tabs. The module doesn't sufficiently sanitize the body fields of the referenced entities when it prints them to the tabs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission create/edit content o...

Mozilla: Use-after-free while editing form elements (MFSA 2018-03)

A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR 52.6 and Thunderbird 52.6...

Unauthorized Access

loopback-datasource-juggler is vulnerable to unauthorized access. The library does not properly enforce foreign key editing, allowing a malicious user to access and edit the ownership of foreign keys of arbitrary records. This only affects databases with many-to-many relationships...

CVE-2018-6007

CVE-2018-6007 describes a cross‑site request forgery in the Joomla! JS Support Ticket 1.1.0 component. The vulnerability allows an attacker to perform unauthorized actions such as injecting HTML or editing support tickets, via CSRF without explicit user interaction in the documented description. ...

UBUNTU-CVE-2018-5096

A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR 52.6 and Thunderbird 52.6...

Mozilla: Use-after-free while editing form elements (MFSA 2018-03)

A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR 52.6 and Thunderbird 52.6...

Confluence REST API for reading and updating wiki pages

In previous posts I wrote how to automate the work with Atlassian Jira, including automated ticket labeling. Now let's try to use REST API of another popular Atlassian product - Confluence wiki engine. What you may want to automate in Confluence? Obviously, it may be useful to read the pages that...

CVE-2018-5706

An issue was discovered in Octopus Deploy before 4.1.9. Any user with user editing permissions can modify teams to give themselves Administer System permissions even if they didn't have them, as demonstrated by use of the RoleEdit or TeamEdit permission...

Code injection

An issue was discovered in Octopus Deploy before 4.1.9. Any user with user editing permissions can modify teams to give themselves Administer System permissions even if they didn't have them, as demonstrated by use of the RoleEdit or TeamEdit permission...

Code injection

PrestaShop 1.7.2.4 has XSS via source-code editing on the "Pages Edit page" screen...

CVE-2018-5681

PrestaShop 1.7.2.4 has XSS via source-code editing on the "Pages Edit page" screen...

CVE-2018-5681

PrestaShop 1.7.2.4 is affected by a cross-site scripting (XSS) vulnerability that can be triggered via the Source Code editing option on the Pages > Edit page screen. The issue is documented in CVE-2018-5681 with notes that the vulnerability exists in the 1.7.2.4 release and is disclosed by mu...

CVE-2018-5681

PrestaShop 1.7.2.4 has XSS via source-code editing on the "Pages Edit page" screen...

PT-2018-17080

Name of the Vulnerable Software and Affected Versions: PrestaShop version 1.7.2.4 Description: The issue allows for XSS via source-code editing on the "Pages Edit page" screen. Recommendations: For PrestaShop version 1.7.2.4, update to a version that fixes this issue to prevent exploitation...

CVE-2018-5681: Improper Neutralization of Input During Web Page Generation

PrestaShop 1.7.2.4 has XSS via source-code editing on the "Pages Edit page" screen...

[SECURITY] Fedora 27 Update: gimp-2.8.22-3.fc27

GIMP GNU Image Manipulation Program is a powerful image composition and editing program, which can be extremely useful for creating logos and other graphics for webpages. GIMP has many of the tools and filters you would exp ect to find in similar commercial offerings, and some interesting extras ...

PT-2018-5748

Name of the Vulnerable Software and Affected Versions: IBM UrbanCode Deploy versions 6.1 through 6.2 Description: The issue is related to improper access controls, allowing an authenticated user to edit objects they should not have access to. Recommendations: For versions 6.1 and 6.2, update to a...

CVE-2017-1000463

Leafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability, within the edit blog post page, which can result in disruption of service and execution of javascript code...

[SECURITY] Fedora 26 Update: evince-3.24.2-2.fc26

Evince is simple multi-page document viewer. It can display and print Portable Document Format PDF, PostScript PS and Encapsulated PostScript EPS files. When supported by the document format, evince allows searching for text, copying text to the clipboard, hypertext navigation, table-of-contents...