WordPress Real Estate Theme 2.8.9 Cross Site Scripting

Exploit Title: Real Estate 7 - Real Estate WordPress Theme v2.8.9 Persistent XSS Injection Google Dork: inurl:"/wp-content/themes/realestate-7/" Date: 2019/07/20 Author: m0ze Vendor Homepage: https://contempothemes.com Software Link:...

WordPress Theme Real Estate 2.8.9 - Cross-Site Scripting

WordPress Theme Real Estate 2.8.9 - Cross-Site Scripting Exploit Title: Real Estate 7 - Real Estate WordPress Theme v2.8.9 Persistent XSS Injection Google Dork: inurl:"/wp-content/themes/realestate-7/" Date: 2019/07/20 Author: m0ze Vendor Homepage: https://contempothemes.com Software Link:...

CVE-2019-1010091

Removed by vendor...

CVE-2019-1010091

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab...

CVE-2019-1010091: Improper Neutralization of Input During Web Page Generation

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab...

Khan Academy: RTL override char allowed at khanacademy redirect page

Summary Attacker can embed RTLO character at the following URL https://www.khanacademy.org/computer-programming/linkredirector?url= to trick the user to download suspicious files. Steps to reproduce Visit https://www.khanacademy.org/computer-programming/linkredirector?url= add the following paylo...

Insert or Embed Articulate Content into WordPress plugin <= 4.2998 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability found in Insert or Embed Articulate Content into WordPress plugin versions = 4.2998. Solution Update the Insert or Embed Articulate Content into WordPress plugin to the latest available version at least 4.2999...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +3524 more potentially affected by CVE-2019-10072 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.40)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2019-10072 Source...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.hyacinth.framework:core-service-admin-server (0.5.0) +1982 more potentially affected by CVE-2019-0199 +1 more via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =greenwich.sr1, =greenwich.sr1, =greenwich.sr1, =0.9.6, =0.0.1, =0.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2019-0199, CVE-2019-10072 Source advisory: GHSA-Q4HG-RMQ2-52Q9...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +3524 more potentially affected by CVE-2019-0199 +1 more via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.40)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2019-0199, CVE-2019-100...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.hyacinth.framework:core-service-admin-server (0.5.0) +1982 more potentially affected by CVE-2019-0199 +1 more via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =greenwich.sr1, =greenwich.sr1, =greenwich.sr1, =0.9.6, =0.0.1, =0.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2019-0199, CVE-2019-10072 Source advisory: MEND:CVE-2019-10072...

WordPress plugin Insert or Embed Articulate Content into WordPress remote code execution vulnerability (CNVD-2019-22391)

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A remote code execution vulnerability exists in the WordPress plugin Insert or Embed...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +3504 more potentially affected by CVE-2019-0221 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.39)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2019-0221 Source...

ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.29) +285 more potentially affected by CVE-2019-0221 via org.apache.tomcat.embed:tomcat-embed-core (>=7.0.0, <=7.0.93)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =7.0.0, =0.0.1, =1.0, =1.0, =1.0-beta-1, =2.0.19, =0.10.1, =1.0-release, =1.0-release, =0.1, =0.4, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2019-0221 Source advisory: OSV:GHSA-JJPQ-GP5Q-8Q6W...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +3504 more potentially affected by CVE-2019-0221 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.39)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2019-0221 Source...

ai.hyacinth.framework:core-service-admin-server (0.5.0), ai.hyacinth.framework:core-service-config-server (0.5.0) +1514 more potentially affected by CVE-2019-0221 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.1, <=9.0.16)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.1, =greenwich.sr1, =greenwich.sr1, =greenwich.sr1, =1.0.0, =1.5.2 - ch.puzzle:libpuzzle-demo-spring-boot-rest 0.1.0-rc1 - ch.puzzle:libpuzzle-spring-boot-rest-testing 0.1.0-rc1 - club.mydlq:swagger-kubernetes 2.1.0 -...

ai.hyacinth.framework:core-service-admin-server (0.5.0), ai.hyacinth.framework:core-service-config-server (0.5.0) +1514 more potentially affected by CVE-2019-0221 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.1, <=9.0.16)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.1, =greenwich.sr1, =greenwich.sr1, =greenwich.sr1, =1.0.0, =1.5.2 - ch.puzzle:libpuzzle-demo-spring-boot-rest 0.1.0-rc1 - ch.puzzle:libpuzzle-spring-boot-rest-testing 0.1.0-rc1 - club.mydlq:swagger-kubernetes 2.1.0 -...

ai.hyacinth.framework:core-service-admin-server (0.5.0), ai.hyacinth.framework:core-service-config-server (0.5.0) +1514 more potentially affected by CVE-2019-0221 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.1, <=9.0.16)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.1, =greenwich.sr1, =greenwich.sr1, =greenwich.sr1, =1.0.0, =1.5.2 - ch.puzzle:libpuzzle-demo-spring-boot-rest 0.1.0-rc1 - ch.puzzle:libpuzzle-spring-boot-rest-testing 0.1.0-rc1 - club.mydlq:swagger-kubernetes 2.1.0 -...

ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.29) +285 more potentially affected by CVE-2019-0221 via org.apache.tomcat.embed:tomcat-embed-core (>=7.0.0, <=7.0.93)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =7.0.0, =0.0.1, =1.0, =1.0, =1.0-beta-1, =2.0.19, =0.10.1, =1.0-release, =1.0-release, =0.1, =0.4, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2019-0221 Source advisory: MEND:CVE-2019-0221...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +3504 more potentially affected by CVE-2019-0221 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.39)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2019-0221 Source...