vBulletin 5.x - Remote Command Execution (Metasploit)

vBulletin 5.x - Remote Command Execution Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'vBulletin 5.x 0day pre-quth RCE exploit', 'Description' = %q vBulletin 5.x 0day pre-auth RCE...

Exploit for Code Injection in Vbulletin

PoC exploit for CVE-2019-16759, an RCE vulnerability in vBulleti...

MariaDB 10.3.0 < 10.3.17 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.3.17. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.3.17 advisory. - Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 5.7.2...

CVE-2019-16751

An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting XSS through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects...

CVE-2019-16751

An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting XSS through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects...

Cross site scripting

An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting XSS through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects...

CVE-2019-16751

Devise Token Auth (through 1.1.2) is affected by a Reflected XSS in the omniauth failure endpoint, specifically via the message parameter in the fallback_render method of the omniauth callbacks controller. Unauthenticated attackers can craft a URL to execute malicious JavaScript in a victim’s bro...

CVE-2019-16751

An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting XSS through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects...

CVE-2019-16751

An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting XSS through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects...

CVE-2019-16751: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting XSS through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects...

PT-2019-14810

Name of the Vulnerable Software and Affected Versions Devise Token Auth versions through 1.1.2 Description An issue was discovered in the omniauth failure endpoint, which is vulnerable to Reflected Cross Site Scripting XSS through the message parameter. Unauthenticated attackers can craft a URL...

Vulnerability of the sub-component “Pluggable Auth” of the MySQL Server component of the Oracle MySQL database management system: This feature allows attackers to cause a service failure.

Vulnerability of the Server sub-component: The Pluggable Auth component of the MySQL Server of the Oracle MySQL database management system is related to improper access control. Exploiting this vulnerability may allow a malicious actor to cause service interruptions remotely...

FreeBSD -- Improper checking in SCTP-AUTH shared key update

Problem Description: The SCTP layer does improper checking when an application tries to update a shared key. Therefore an unprivileged local user can trigger a use-after- free situation, for example by specific sequences of updating shared keys and closing the SCTP association. Impact: Triggering...

SUSE SLED12 / SLES12 Security Update : ceph (SUSE-SU-2019:2364-1)

This update for ceph to version 12.2.12-594-g02236657ca fixes the following issues : Security issues fixed : CVE-2018-16889: Fixed missing sanitation of customer encryption keys from log output in v4 auth. bsc1121567 Note that Tenable Network Security has extracted the preceding description block...

CVE-2019-16332

In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS...

Cross site scripting

In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS...

CVE-2019-16332

CVE-2019-16332 affects the WordPress API Bearer Auth plugin prior to 20190907. The vulnerability arises from improper filtering of the server parameter in swagger-config.yaml.php, enabling cross-site scripting (XSS) and injection of malicious scripts. The issue is documented across multiple sourc...

PT-2019-14631

Name of the Vulnerable Software and Affected Versions api-bearer-auth plugin for WordPress versions prior to 20190907 Description The issue concerns the api-bearer-auth plugin for WordPress, where the server parameter in the swagger-config.yaml.php file is not correctly filtered. This allows for...

CVE-2019-16332: Improper Neutralization of Input During Web Page Generation

In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS...

Important: Red Hat Security Advisory: polkit security update

An update for polkit is now available for Red Hat Enterprise Linux 7.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...