Arbitrary Code Execution

httpd is vulnerable to arbitrary code execution. The vulnerability exists as an integer overflow flaw, leading to a heap-based buffer overflow, was found in the way httpd performed substitutions in regular expressions. An attacker able to set certain httpd settings, such as a user permitted to...

Authorization Bypass

php is vulnerable to authorization bypass. A flaw was found in the handling of the "mbstring.funcoverload" configuration setting. A value set for one virtual host, or in a user's .htaccess file, was incorrectly applied to other virtual hosts on the same server, causing the handling of multibyte...

CVE-2019-18782

SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism...

CVE-2019-18782

SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism...

Design/Logic Flaw

SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism...

CVE-2019-18782

Summary: CVE-2019-18782 affects SuiteCRM 7.10.x (before 7.10.21) and 7.11.x (before 7.11.9). The root cause is a misimplementation of the ".htaccess protection mechanism" in these releases. Impact / exploitation: The documents do not provide detailed exploit vectors or concrete consequences beyon...

CVE-2019-18782

SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism...

CVE-2019-18782

SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism...

PT-2020-9981

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions 7.10.x prior to 7.10.21 SuiteCRM versions 7.11.x prior to 7.11.9 Description: The issue is related to the incorrect implementation of the .htaccess protection mechanism. Recommendations: For SuiteCRM versions 7.10.x prior to...

SuiteCRM .htaccess Protection Mechanism Incorrectly Implemented Vulnerability

SuiteCRM is a free open source customer relationship management application. SuiteCRM is vulnerable to an incorrect implementation of the .htaccess protection mechanism. No detailed vulnerability details are provided at this time...

CVE-2019-18782: Undefined Security Weakness

SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism...

WordPress BestWebSoft Htaccess Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. htaccess is an access control plugin used in it. WordPress BestWebSoft Htaccess cross-site request forgery vulnerability, an attacker...

CVE-2020-8658

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

CVE-2020-8658

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

CVE-2020-8658

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

Cross site request forgery (csrf)

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

CVE-2020-8658

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

CVE-2020-8658

The CVE concerns WordPress plugin BestWebSoft Htaccess (

PT-2020-20254

Name of the Vulnerable Software and Affected Versions BestWebSoft Htaccess plugin versions prior to 1.8.2 Description The issue allows for Cross-Site Request Forgery CSRF attacks due to incorrect validation of the htccss nonce name flag, which is supposed to pass a nonce to WordPress for anti-CSR...

CVE-2020-8658: Cross-Site Request Forgery (CSRF)

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...