WordPress WebAppick WooCommerce Product Feed Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WebAppick WooCommerce Product Feed is a plugin used in WordPress to generate product feed data. A cross-site scripting...

WordPress Category Specific RSS feed Subscription plugin <= 2.0 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Gota Abe Cryptography Laboratory in WordPress Category Specific RSS feed Subscription plugin versions = 2.0. Solution Update the WordPress Category Specific RSS feed Subscription plugin to the latest available version at least 2.1...

Category Specific RSS feed Subscription <= 2.0 - Cross-Site Request Forgery (CSRF)

The Category Specific RSS feed Subscription WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...

WordPress Category Specific RSS feed Subscription plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Category Specific RSS feed Subscription is an RSS feed plugin used in it. A cross-site request forgery vulnerability exists in WordPres...

CVE-2019-13640

In qBittorrent before 4.1.7, the function Application::runExternalProgram located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed...

CVE-2019-13640

In qBittorrent before 4.1.7, the function Application::runExternalProgram located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed...

Command injection

In qBittorrent before 4.1.7, the function Application::runExternalProgram located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed...

CVE-2019-13640

In qBittorrent before 4.1.7, the function Application::runExternalProgram located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed...

CVE-2019-13640

In qBittorrent before 4.1.7, the function Application::runExternalProgram located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed...

CVE-2019-13640

In qBittorrent before 4.1.7, the function Application::runExternalProgram located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed...

CVE-2019-13640

In qBittorrent before 4.1.7, the function Application::runExternalProgram located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed...

CVE-2019-13640

In qBittorrent before 4.1.7, the function Application::runExternalProgram located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed...

CVE-2019-13640: Improper Neutralization of Special Elements used in an OS Command

In qBittorrent before 4.1.7, the function Application::runExternalProgram located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed...

Twisted Web Compromise

The vulnerability of the twisted.web network framework exists due to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality and integrity of protected information by introducing invalid characters like CRLF...

Feed Them Gallery <= 1.1.8 - XSS

Changelog for 1.1.9 mentions "Security Refactor of the whole plugin to stop XSS injections and other possibly malicious attempts to hack through the plugin."...

CVE-2019-6636

On BIG-IP AFM, ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability in AFM feed list. In the worst case, an attacker can store a CSRF which results in code execution as the admin user. The level of user role which can...

CVE-2019-6636: Improper Neutralization of Input During Web Page Generation

On BIG-IP AFM, ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability in AFM feed list. In the worst case, an attacker can store a CSRF which results in code execution as the admin user. The level of user role which can...

PT-2019-18218

Name of the Vulnerable Software and Affected Versions BIG-IP AFM, ASM versions 11.5.1 through 11.6.4 BIG-IP AFM, ASM versions 12.1.0 through 12.1.4 BIG-IP AFM, ASM versions 13.0.0 through 13.1.1.4 BIG-IP AFM, ASM versions 14.0.0 through 14.0.0.4 BIG-IP AFM, ASM versions 14.1.0 through 14.1.0.5...

CVE-2017-8409

An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce the same restriction on a specific URL thereby allowing any attacker in possession of that to view the live video feed...

CVE-2017-8405

An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary loads at address 0x00012CF4 a flag called "Authenticate" that indicates whether a user should be...