6815 matches found
CVE-2018-7198
October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...
CVE-2018-7198
CVE-2018-7198 affects October CMS up to version 1.0.431, specifically the RainLab Blog Plugin. It enables stored XSS by entering HTML on the Add Posts page, allowing a malicious payload to be stored and subsequently executed. The issue is documented across multiple sources (GHSA/OSV and exploit r...
Dropbox: Forum posts and private messages are poorly sanitized, allowing execution of arbitrary JavaScript
The reporter informed us of both stored XSS vulnerabilities as well as unsafe css attributes that were allowed in forum posts due to TinyMCE editor. An upgrade to lithium's forum platform appears to have mitigated these vulnerabilities...
CVE-2017-15399
creationtimestamp| type| source ---|---|--- 2018-01-29 14:31:45+00:00| published-proof-of-concept| https://t.me/R0Crew/405 2018-01-30 05:26:35+00:00| published-proof-of-concept| https://t.me/br0wsec/25 2018-01-30 07:40:25+00:00| published-proof-of-concept| https://t.me/antichat/774 2018-01-30...
WordPress Plugin Admin Menu Tree Page View 2.6.9 - Cross-Site Request Forgery Privilege Escalation
WordPress Plugin Admin Menu Tree Page View 2.6.9 - Cross-Site Request Forgery Privilege Escalation Exploit Title: Admin Menu Tree Page View CSRF, Privilege Escalation Discovery Date: 2017-12-12 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage:...
WordPress Plugin CMS Tree Page View 1.4 - Cross-Site Request Forgery Privilege Escalation
WordPress Plugin CMS Tree Page View 1.4 - Cross-Site Request Forgery Privilege Escalation Exploit Title: CMS Tree Page View CSRF, Privilege Escalation Discovery Date: 2017-12-12 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://eskapism.se/...
WordPress CMS Tree Page View 1.4 Plugin - Cross-Site Request Forgery / Privilege Escalation Exploit
Exploit for php platform in category web applications Exploit Title: CMS Tree Page View CSRF, Privilege Escalation Discovery Date: 2017-12-12 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://eskapism.se/ Software Link:...
WordPress CMS Tree Page View 1.4 CSRF / Privilege Escalation
Exploit Title: CMS Tree Page View CSRF, Privilege Escalation Discovery Date: 2017-12-12 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://eskapism.se/ Software Link: https://wordpress.org/plugins/cms-tree-page-view Version: 1.4 Tested on:...
WordPress Admin Menu Tree Page View 2.6.9 CSRF / Privilege Escalation
Exploit Title: Admin Menu Tree Page View CSRF, Privilege Escalation Discovery Date: 2017-12-12 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://eskapism.se/ Software Link: https://wordpress.org/plugins/admin-menu-tree-page-view Version: 2.6.9...
VK.com: CSRF в m.vk.com
Отсутствие проверки хеша при скрытии записей в мобильной ленте...
CVE-2017-11882
creationtimestamp| type| source ---|---|--- 2017-11-15 11:11:01+00:00| exploited| https://t.me/informationsecuritychannel/11068 2017-11-15 18:56:28+00:00| seen| https://t.me/cybershit/173 2017-11-15 21:50:34+00:00| exploited| https://t.me/informationsecuritychannel/11105 2017-11-21 07:39:51+00:00...
My Blogging
Blog regulars will notice that I haven't been posting as much lately as I have in the past. There are two reasons. One, it feels harder to find things to write about. So often it's the same stories over and over. I don't like repeating myself. Two, I am busy writing a book. The title is still:...
EMC RSA Archer Privilege Bypass Vulnerability
EMC RSA Archer is an enterprise IT governance and compliance governance product from EMC Corporation EMC. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. A privilege bypass vulnerability exists in EMC RSA Archer. A remote...
FIN10 Extorting Canadian Mining Companies, Casinos
Cybercriminals targeting casinos and mining firms in North America have extorted as much as $620,000 per theft during a four-year run in which they threaten victims with the destruction or public release of stolen data. Between 2013 and 2016, mostly Canadian firms were hit with nearly a dozen...
Sensitive Information Leak
Moodle is vulnerable to a sensitive information leak. blog/rsslib.php does not prevent guest users from accessing sensitive information from hidden blog posts through related RSS feeds for site-level blogs...
Cross-site Request Forgery (CSRF)
Moodle is vulnerable to cross-site request forgery CSRF attacks. The attacks exist because the checking of session keys is not done in markposts.php, allowing an attacker to hijack an authentication of user for requests that marks forum posts as read...
WordPress REST API Posts Controller Privilege Escalation
A privilege escalation vulnerability exists in WordPress. The vulnerability is due to improper handling of post id's within the REST API posts controller. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted request to a vulnerable WordPress website...
Code injection
cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts Add New" action, and during creation of new tags and users...
