CVE-2019-15871

The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings...

September 3, 2019, update for Office 2016 (KB4475580)

None None...

WordPress nd-shortcodes plugin unauthorized operation vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. nd-shortcodes is a drag-and-drop page builder plugin used in it. A security vulnerability exists in WordPress nd-shortcodes plugin...

CVE-2019-15821

The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data...

Code injection

The nd-shortcodes plugin before 6.0 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

CVE-2019-15775

The nd-learning plugin before 4.8 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

Code injection

The nd-travel plugin before 1.7 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

Code injection

The nd-donations plugin before 1.4 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

CVE-2019-15774

The nd-booking plugin before 2.5 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

Design/Logic Flaw

The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action...

CVE-2017-18584

CVE-2017-18584 : The WordPress plugin “post-pay-counter” prior to version 2.731 exposes an update-settinga action without a permissions check, enabling unauthorized usage. Root cause: missing access control in the plugin’s update-settinga workflow. Impact: as described in multiple sources, this c...

Surveillance as a Condition for Humanitarian Aid

Excellent op-ed on the growing trend to tie humanitarian aid to surveillance. Despite the best intentions, the decision to deploy technology like biometrics is built on a number of unproven assumptions, such as, technology solutions can fix deeply embedded political problems. And that auditing fo...

CVE-2019-15062

An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element containing a user/card.php CSRF request in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. The protection mechanism for CSRF is to check the Referer...

Encryption Key Negotiation of Bluetooth Vulnerability

Executive Summary Microsoft is aware of the Bluetooth BR/EDR basic rate/enhanced data rate, known as "Bluetooth Classic" key negotiation vulnerability that exists at the hardware specification level of any BR/EDR Bluetooth device. An attacker could potentially be able to negotiate the offered key...

systemd security, bug fix, and enhancement update

219-67.0.1 - do not create utmp update symlinks for reboot and poweroff Orabug: 27854896 - OL7 udev rule for virtio net standby interface Orabug: 28826743 - fix netdev is missing for iscsi entry in /etc/fstab Orabug: 25897792 [email protected] - set 'RemoveIPC=no' in logind.conf as default fo...

CVE-2017-18430

In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassignpostterminatecruft SEC-294...

CVE-2019-7615

A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the 'servercacert' setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the...

HackerOne: Program Email Nofication settings ignored when being added as an external contributor

Summary: When being added as an external contributor to a report, the report title are displayed in the email notification despite the program email notification settings being set to No Content Description: Hey team! I noticed that programs have the ability to set their Email Notification...

Workspace app for ios default display settings

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company's Help Desk/IT support team and can refer to CTX297149 for more information. What is the default setting for Workspace app for iOS on iPhones? Display settings are not all the...

WordPress Slimstat Analytics plugin <= 4.8.3 - Cross-Site Request Forgery (CSRF) to Stored Cross-Site Scripting (XSS) + Setting Updates vulnerabilities

Cross-Site Request Forgery CSRF to Stored Cross-Site Scripting XSS + Setting Updates vulnerabilities found in WordPress Slimstat Analytics plugin versions = 4.8.3. Solution Update the WordPress Slimstat Analytics plugin to the latest available version at least 4.8.4...