CVE-2017-18178

Progress Sitefinity 9.1 is affected by CVE-2017-18178, an open redirect in Authenticate/SWT where an authentication token may be sent to the redirection target when the target is specified using a particular %40 syntax. The issue is resolved in version 10.1. No exploitation details are provided i...

CVE-2017-18176

Progress Sitefinity 9.1 is affected by a cross‑site scripting (XSS) vulnerability triggered by file uploads, where JavaScript in an HTML file shares origin with the app’s code. Details from multiple sources confirm the issue and that it is fixed in Sitefinity 10.1. The root cause is an XSS condit...

PT-2018-6712

Name of the Vulnerable Software and Affected Versions: Progress Sitefinity versions prior to 10.1 Description: The issue concerns the use of a non-expiring authentication token, wrap access token, which remains valid even after a password change or session termination. This token is also...

PT-2018-6708

Name of the Vulnerable Software and Affected Versions: Progress Sitefinity versions prior to 10.1 Description: The issue concerns a problem with the Content Management Template Configuration, also known as Templateconfiguration, where an XSS attack can be performed. This is demonstrated by the sr...

CVE-2017-18179: Improper Authentication

Progress Sitefinity 9.1 uses wrapaccesstoken as a non-expiring authentication token that remains valid after a password change or a session termination. Also, it is transmitted as a GET parameter. This is fixed in 10.1...

PT-2018-6710

Name of the Vulnerable Software and Affected Versions: Progress Sitefinity versions prior to 10.1 Description: The issue concerns a problem where malicious input can be injected via the Last name, First name, and About fields on the New User Creation Page, allowing for potential attacks...

PT-2018-6709

Name of the Vulnerable Software and Affected Versions: Progress Sitefinity versions prior to 10.1 Description: The issue allows for XSS via file upload. This occurs because JavaScript code in an HTML file has the same origin as the application's own code. Recommendations: For versions prior to...

Fedora 27 : flatpak (2018-bd651734da)

This is a security fix release that fixes a sandbox escape in the flatpak dbus proxy. This issue was found by Gabriel Campana of The Google Security Team. Major changes in 0.10.3 - Fix dbus proxy vulnerability in authentication phase - Make permission handling ignore unknown permissions for...

Fedora 26 : flatpak (2018-b5ecac9405)

This is a security fix release that fixes a sandbox escape in the flatpak dbus proxy. This issue was found by Gabriel Campana of The Google Security Team. Major changes in 0.10.3 - Fix dbus proxy vulnerability in authentication phase - Make permission handling ignore unknown permissions for...

Fedora 27 : libzip (2017-7bd193c0ed)

Version 1.3.0 It contains fixes for two possible security problems. The problems were identified by Brian 'geeknik' Carpenter and Agostino Sarubbo using AFL. The changes are : - Support bzip2 compressed zip archives - Improve file progress callback code - Fix zipfdopen - CVE-2017-12858: Fix doubl...

Visualizing Spectre/Meltdown Impact and Remediation Progress

In order to determine the impact of Spectre/Meltdown and track remediation progress across your entire environment, it is important to visualize vulnerability detections in a dynamic dashboard. For more information on Spectre and Meltdown, please see our previous blog. Using Qualys AssetView, we...

spreenow.com XSS vulnerability

Vulnerable URL: https://www.spreenow.com/search-taobao ?s=" =" Details: Description| Value ---|--- Patched:| Verification in progress Latest check for patch:| 29.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1392579 VIP website status:| No Coordinated...

Sitefinity CMS < 10.1.6527.0 Multiple Vulnerabilities

Sitefinity CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:progress:sitefinity"; if...

Sitefinity CMS Detection (HTTP)

HTTP based detection of Sitefinity CMS. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.140540";...

Progress Sitefinity 10.0 / 10.1 Broken Access Control / LINQ Injection Vulnerability

Exploit for multiple platform in category web applications ======================================================================= title: Broken access control & LINQ injection product: Progress Sitefinity vulnerable version: 10.0, 10.1 fixed version: =10.1.6527.0 internal build, 10.2 CVE number:...

Progress Sitefinity 10.0 / 10.1 Broken Access Control / LINQ Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Broken access control & LINQ injection product: Progress Sitefinity vulnerable version: 10.0, 10.1 fixed version: =10.1.6527.0 internal build, 10.2 CVE number: - impact:...

CVE-2015-9245

Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malicious Java classes via port 20931...

CVE-2015-9245

Progress Software OpenEdge 10.2x and 11.x are affected by CVE-2015-9245 due to an insecure default configuration. The vulnerability allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malicious Java classes through port 20931. This is rooted in the def...

PT-2017-3369

Name of the Vulnerable Software and Affected Versions Progress Software OpenEdge versions 10.2x through 11.x Description The issue is related to an insecure default configuration that lacks proper access control, allowing unauthenticated remote attackers to load and execute malicious Java classes...

CVE-2015-9245: Improper Access Control

Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malicious Java classes via port 20931...