CMS Made Simple admin/moduleinterface.php Reflective Cross-Site Scripting Vulnerability

CMS Made Simple is a content management system developed using PHP, MySQL and Smarty template engine. A reflected cross-site scripting vulnerability exists in admin/moduleinterface.php in CMS Made Simple 2.2.7. The vulnerability can be exploited to conduct cross-site scripting attacks via the...

CVE-2018-10032

CMS Made Simple aka CMSMS 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1version parameter...

PT-2018-9637

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions 2.2.7 Description: The issue is related to Reflected XSS in the admin/moduleinterface.php file via the m1 version parameter. Recommendations: For version 2.2.7, avoid using the m1 version parameter in the...

PT-2018-9634

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions 2.2.7 Description: The issue is related to Reflected XSS in the admin/moduleinterface.php file via the m1 name parameter, which is connected to moduledepends. Recommendations: For version 2.2.7, consider restricting...

Apache Tomcat Security Constraint Incorrect Handling Access Bypass Vulnerabilities - Windows

Apache Tomcat is prone to multiple access bypass vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat";...

Apache Tomcat Security Constraint Incorrect Handling Access Bypass Vulnerabilities - Linux

Apache Tomcat is prone to multiple access bypass vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat";...

Fixed in Apache Tomcat 9.0.5

Important: Security constraint annotations applied too late CVE-2018-1305 Security constraints defined by annotations of Servlets were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2018-02621)

CMS Made Simple is a simple, easy-to-use content management system developed using PHP, MySQL and Smarty template engine. A cross-site scripting vulnerability exists in CMS Made Simple CMSMS 2.2.5. The vulnerability can be exploited to conduct cross-site scripting attacks via the m1messages...

CVE-2018-5965

CMS Made Simple CMSMS 2.2.5 has XSS in admin/moduleinterface.php via the m1errors parameter...

PT-2018-17252

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.5 Description: The issue is related to XSS in the admin/moduleinterface.php file via the m1 messages parameter. Recommendations: For CMS Made Simple version 2.2.5, avoid using the m1 messages parameter in the...

PT-2018-17253

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.5 Description: The issue is related to XSS in the admin/moduleinterface.php file via the m1 errors parameter. Recommendations: For CMS Made Simple version 2.2.5, update to a newer version that contains a fix for th...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2017-36502)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in the...

CVE-2017-16799

In CMS Made Simple 2.2.3.1, in modules/New/action.addcategory.php, stored XSS is possible via the m1name parameter to admin/moduleinterface.php during addition of a category, a related issue to CVE-2010-3882...

PT-2017-14569

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.3.1 Description The issue allows for stored XSS via the m1 name parameter to "admin/moduleinterface.php" during the addition of a category. Recommendations For CMS Made Simple version 2.2.3.1, avoid using the m1 nam...

CVE-2017-7675

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL...

Akka Remoting Component Remote Code Execution Vulnerability

Akka is an open source toolkit for building highly concurrent and distributed message-driven applications.Remoting component is one of the remote interaction component. A security vulnerability exists in the Remoting component in Akka versions 2.4.16 and earlier and 2.5-M1. A remote attacker can...

Pivotal Spring Security Deserialization Remote Code Execution Vulnerability

Pivotal Spring Security is a suite of security frameworks from Pivotal Software that provide illustrative security protection for Spring-based applications. A remote code execution vulnerability exists in Pivotal Spring Security versions 4.2.0 through 4.2.2 and 5.0.0.M1. A remote attacker could...

CVE-2017-5664

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the origin...

Apache Tomcat 'SecurityManager' Information Disclosure Vulnerability (Apr 2017) - Windows

Apache Tomcat is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"...

Amazon Linux AMI : tomcat6 (ALAS-2017-821)

Incorrect handling of pipelined requests when send file was used : A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lo...