PT-2018-9570

Name of the Vulnerable Software and Affected Versions FreshDNS versions 1.0.3 and earlier Description The issue concerns a Cross-Site Request Forgery CSRF vulnerability that affects all authenticated API calls in index.php and class.manager.php. This can lead to the editing of domains and zones...

CVE-2018-1000846: Cross-Site Request Forgery (CSRF)

FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery CSRF vulnerability in All authenticated API calls in index.php / class.manager.php that can result in Editing domains and zones with victim's privileges. This attack appear to be exploitable via Victim must open a website...

CVE-2018-17777

An issue was discovered on D-Link DVA-5592 A1WI20180823 devices. If the PIN of the page "/ui/cbpc/login" is the default Parental Control PIN 0000, it is possible to bypass the login form by editing the path of the cookie "sid" generated by the page. The attacker will have access to the router...

RATELIMITED: Editable Wiki repo by anyone

Description: I've created wiki page on your github repo without any permission Steps To Reproduce: https://github.com/EndlessHosting/Discord-LiveBot/wiki/Test-here Supporting Material/References: F391468 Impact Going on https://github.com/EndlessHosting/Discord-LiveBot/wiki/Test-here you can add ...

Liberapay: Publicly editable GitHub wikis

Hello team, While browsing https://github.com/liberapay I found that many of the repositories have their wikis publicly editable by any GitHub user. The following are some of the affected repositories: https://github.com/liberapay/cardregistration-js-kit/wiki...

MariaDB: Github wiki is editable by anyone

Some of our GitHub repos had default public Wiki editing turned on, which could be used with malicious intent...

DRUPAL-CONTRIB-2018-074

This base theme bridges the gap between Drupal and the Bootstrap Framework. The theme doesn't sufficiently filter valid targets under the scenario of opening modals, popovers, and tooltips. This vulnerability is mitigated by the fact that an attacker must already have the ability to either: 1...

WordPress 3.7.x < 3.7.17 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the PHPMailer component in the class.phpmailer.php script due to improper handling of sender email addresses. An...

WordPress 3.9.x < 3.9.15 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the PHPMailer component in the class.phpmailer.php script due to improper handling of sender email addresses. An...

WordPress 4.2.x < 4.2.11 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the PHPMailer component in the class.phpmailer.php script due to improper handling of sender email addresses. An...

RHEL 7 : zsh (RHSA-2018:3073)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3073 advisory. The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh...

CVE-2018-18745

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSMenu.php?lgid=1 during editing...

CVE-2018-18745

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSMenu.php?lgid=1 during editing...

CVE-2018-18741

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSDownload.php?lgid=1 during editing...

CVE-2018-18741

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSDownload.php?lgid=1 during editing...

Cross site scripting

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSMenu.php?lgid=1 during editing...

CVE-2018-18741

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSDownload.php?lgid=1 during editing...

CVE-2018-18745

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSMenu.php?lgid=1 during editing...

CVE-2018-18745: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSMenu.php?lgid=1 during editing...

NVP field - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-066

NVP field module allows you to create a field type of name/value pairs, with custom titles and easily editable rendering with customizable HTML/text surrounding the pairs. The module doesn't sufficiently handle sanitization of its field formatter's output. This vulnerability is mitigated by the...