PT-2018-9706

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: The issue arises from improper sanitization of specially crafted web requests to an affected SharePoint server, potentially allowing an attacker to redirect users...

Aspen < 0.22 Directory Traversal

According to its banner, the version of Aspen running on the remote host is prior to 0.22. It is, therefore, affected by a directory traversal vulnerability due to improper sanitization of user-supplied input. Note that Nessus has not tested for this issue but has instead relied only on the...

CVE-2018-0915

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909,...

PT-2018-9148

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: An issue exists due to improper sanitization of specially crafted web requests. This could allow an attacker to perform cross-site scripting attacks, potentially enablin...

PT-2018-9165

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: An issue exists due to improper sanitization of specially crafted web requests. This could allow an attacker to perform cross-site scripting attacks, potentially enablin...

PT-2018-9147

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: An issue exists due to improper sanitization of specially crafted web requests. This could allow an attacker to perform cross-site scripting attacks, potentially enablin...

PT-2018-9143

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: An issue exists due to improper sanitization of specially crafted web requests. This could allow an attacker to perform cross-site scripting attacks, potentially enablin...

PT-2018-9150

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: An issue exists due to improper sanitization of specially crafted web requests, allowing for cross-site scripting attacks. This could enable an attacker to read...

CVE-2018-7753

An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized...

PT-2018-9142

Name of the Vulnerable Software and Affected Versions: Microsoft Identity Manager 2016 SP1 Description: The issue arises from the improper sanitization of a specially crafted attribute value, which is displayed to a user on an affected server. This allows an attacker to gain elevated privileges...

Accesspress Anonymous Post Pro Unauthenticated Arbitrary File Upload

Exploit Title: Unauthenticated Arbitrary File Upload Date: November 12, 2017 Exploit Author: Colette Chamberland Author contact: [email protected] Author homepage: https://defiant.com Vendor Homepage: https://accesspressthemes.com/ Software Link:...

Accesspress Anonymous Post Pro 3.2.0 - Arbitrary File Upload

Accesspress Anonymous Post Pro 3.2.0 - Arbitrary File Upload Exploit Title: Unauthenticated Arbitrary File Upload Date: November 12, 2017 Exploit Author: Colette Chamberland Author contact: [email protected] Author homepage: https://defiant.com Vendor Homepage: https://accesspressthemes.com/...

PT-2017-12316

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Enterprise Server 2016 Description The issue arises from the way web requests are handled. An elevation of privilege issue exists due to improper sanitization of specially crafted web requests to an affected SharePoint...

PT-2017-12237

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server affected versions not specified Description A cross-site scripting issue exists due to improper sanitization of specially crafted web requests. An authenticated attacker can exploit this by sending a crafted request...

PT-2017-18506

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Foundation 2013 Service Pack 1 Microsoft SharePoint Server affected versions not specified Description The issue arises from improper sanitization of specially crafted web requests to an affected SharePoint server. An...

PT-2017-17316

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure version 3.20.0 Description A vulnerability in the administrative web interface could allow an authenticated, remote attacker to modify a page in the web interface. The issue is due to improper sanitization of paramet...

FreeBSD : GitLab -- two vulnerabilities (abcc5ad3-7e6a-11e7-93f7-d43d7e971a1b)

GitLab reports : Remote Command Execution in git client An external code review performed by Recurity-Labs identified a remote command execution vulnerability in git that could be exploited via the 'Repo by URL' import option in GitLab. The command line git client was not properly escaping comman...

CVE-2017-7798

The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code. In the worst case, this could allow arbitrary code execution when opening a malicious page with the style editor tool. This vulnerability affects Firefox ESR 52.3 and...

GitLab -- two vulnerabilities

GitLab reports: Remote Command Execution in git client An external code review performed by Recurity-Labs identified a remote command execution vulnerability in git that could be exploited via the "Repo by URL" import option in GitLab. The command line git client was not properly escaping command...

PT-2017-6685

Name of the Vulnerable Software and Affected Versions phpMyBackupPro versions 2.5 and earlier Description The issue allows remote authenticated users to execute arbitrary PHP code by storing a crafted string in a user configuration file, due to improper sanitization of input strings...