|
265121
|
9.8 |
CRITICAL
Network
|
ktools
|
photostore
|
SQL injection vulnerability in the mgr.login.php file in Ktools.net Photostore before 4.7.5 allows remote attackers to execute arbitrary SQL commands via the email parameter in a recover_login action.
|
CWE-89
SQL Injection
|
CVE-2016-4337
|
2024-11-21 11:51 |
2017-04-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
265122
|
6.1 |
MEDIUM
Network
|
jivesoftware
|
jive
|
Jive before 2016.3.1 has an open redirect from the external-link.jspa page.
|
CWE-601
Open Redirect
|
CVE-2016-4334
|
2024-11-21 11:51 |
2017-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
265123
|
4.3 |
MEDIUM
Network
|
atlassian
|
bitbucket
|
Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull requests resource.
|
CWE-22
Path Traversal
|
CVE-2016-4320
|
2024-11-21 11:51 |
2017-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
265124
|
8.8 |
HIGH
Network
|
atlassian
|
jira
|
Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings.
|
CWE-352
Origin Validation Error
|
CVE-2016-4319
|
2024-11-21 11:51 |
2017-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
265125
|
4.8 |
MEDIUM
Network
|
atlassian
|
jira
|
Atlassian JIRA Server before 7.1.9 has XSS in project/ViewDefaultProjectRoleActors.jspa via a role name.
|
CWE-79
Cross-site Scripting
|
CVE-2016-4318
|
2024-11-21 11:51 |
2017-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
265126
|
5.4 |
MEDIUM
Network
|
atlassian
|
confluence
|
Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page.
|
CWE-79
Cross-site Scripting
|
CVE-2016-4317
|
2024-11-21 11:51 |
2017-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
265127
|
4.9 |
MEDIUM
Network
|
plone
|
plone
|
Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates.
|
CWE-264
Permissions, Privileges, and Access Controls
|
CVE-2016-4043
|
2024-11-21 11:51 |
2017-02-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
265128
|
5.3 |
MEDIUM
Network
|
plone
|
plone
|
Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors.
|
CWE-200
Information Exposure
|
CVE-2016-4042
|
2024-11-21 11:51 |
2017-02-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
265129
|
7.3 |
HIGH
Network
|
plone
|
plone
|
Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors.
|
CWE-264
Permissions, Privileges, and Access Controls
|
CVE-2016-4041
|
2024-11-21 11:51 |
2017-02-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
265130
|
6.1 |
MEDIUM
Network
|
wso2
|
enablement_server_for_java
|
Cross-site scripting (XSS) vulnerability in WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH…
|
CWE-79
Cross-site Scripting
|
CVE-2016-4327
|
2024-11-21 11:51 |
2017-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|