November 22, 2017 – Morning Cyber Coffee Headlines – “Thanksgiving Week” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! November 22, 2017 - Headlines Carbon Black in the News: Holiday season scams:...

Perch CMS 3.0.3 Cross Site Scripting / File Upload Vulnerabilities

Exploit for php platform in category web applications Document Title: =============== Perch v3.0.3 CMS - Multiple Web Vulnerabilities Vulnerability Class: ==================== Arbitrary File Upload Product & Service Introduction: =============================== Perch is a content management syste...

Xavier v2.4 PHP MP - SQL Injection Web Vulnerabilities

Document Title: =============== Xavier v2.4 PHP MP - SQL Injection Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2076 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15949 CVE-ID: ======= CVE-2017-15949 Release Date:...

Perch v3.0.3 CMS - Multiple Web Vulnerabilities

Document Title: =============== Perch v3.0.3 CMS - Multiple Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2067 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15948 CVE-ID: ======= CVE-2017-15948 Release Date: ============...

Perch v3.0.3 CMS - Multiple Web Vulnerabilities

Document Title: =============== Perch v3.0.3 CMS - Multiple Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2067 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15948 CVE-ID: ======= CVE-2017-15948 Release Date: ============...

TrueConf Server 4.3.7 - Multiple Vulnerabilities

TrueConf Server 4.3.7 - Multiple Vulnerabilities TrueConf Server v4.3.7 Multiple Remote Web Vulnerabilities Vendor: TrueConf LLC Product web page: https://www.trueconf.com Affected version: 4.3.7.12255 and 4.3.7.12219 Summary: TrueConf Server is a powerful, high-quality and highly secured video...

TrueConf Server 4.3.7 - Multiple Vulnerabilities

TrueConf Server v4.3.7 Multiple Remote Web Vulnerabilities Vendor: TrueConf LLC Product web page: https://www.trueconf.com Affected version: 4.3.7.12255 and 4.3.7.12219 Summary: TrueConf Server is a powerful, high-quality and highly secured video conferencing software server. It is specially...

CVE-2016-7137

Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to 1...

Multiple stored cross-site scripting vulnerabilities in PHPCMS

PHPCMS is an open source website management software.PHPCMS V9 V9 for short uses PHP5+MYSQL as the technical basis for development. The latest version of PHPCMS has multiple stored cross-site scripting vulnerabilities that can be exploited by attackers to inject arbitrary JavaScript code into the...

FortiCloud Cross Site Script Persistent Web Vulnerabilities

Forticloud online service before May 3, 2016 was exposed to cross site scripting web vulnerabilities, which could allow malicious script being injected in the affected module; this potentially enables XSS attacks...

FortiManager (Series) - Multiple Web Vulnerabilities

Document Title: =============== FortiManager Series - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1684 Fortinet PSIRT ID: 1624459 Bulletin:...

FortiManager Script Insertion

Document Title: =============== FortiManager Series - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1684 Fortinet PSIRT ID: 1624459 Release Notes 1:...

ZMS v3.2 CMS - Client Side Cross Site Web Vulnerabilities

Document Title: =============== ZMS v3.2 CMS - Client Side Cross Site Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1890 Release Date: ============= 2016-07-27 Vulnerability Laboratory ID VL-ID: ====================================...

UBUNTU-CVE-2016-5733

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 a crafted table name that is mishandled during privilege checking in...

Iranian Weblog Services 3.3 Cross Site Scripting / Shell Upload / SQL Injection

Document Title: =============== Iranian Weblog Services v3.3 CMS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1862 CWE-89 CWE-79 CWE-264 http://cwe.mitre.org/data/definitions/89 http://cwe.mitre.org/data/definitions/79...

Negin Group CMS - (v) Multiple Web Vulnerabilities

Document Title: =============== Negin Group CMS - v Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1831 Release Date: ============= 2016-04-24 Vulnerability Laboratory ID VL-ID: ==================================== 1831 Comm...

Ahrare Andeysheh CMS - Multiple Web Vulnerabilities

Document Title: =============== Ahrare Andeysheh CMS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1827 Release Date: ============= 2016-04-18 Vulnerability Laboratory ID VL-ID: ==================================== 1827...

Ahrare Andeysheh CMS - Multiple Web Vulnerabilities

Document Title: =============== Ahrare Andeysheh CMS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1827 Release Date: ============= 2016-04-17 Vulnerability Laboratory ID VL-ID: ==================================== 1827...

Learn Croatian. Speak Croatian - Dangerous filesystem permissions, MIT license, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Learn Croatian. Speak Croatian published at the 'play' market has multiple vulnerabilities...

Docker UI 0.10.0 Cross Site Request Forgery

Document Title: =============== Docker UI v0.10.0 - Multiple Client Side Cross Site Request Forgery Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1802 Release Date: ============= 2016-03-28 Vulnerability Laboratory ID VL-ID:...