CVE-2018-9209

Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server = v1.2.2...

CVE-2018-9209

Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server = v1.2.2...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Network Performance Insight

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version IBM JRE 8.0.2.10 used by IBM Network Performance Insight. IBM Network Performance Insight has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivere...

CVE-2018-19053

CVE-2018-19053 affects PbootCMS 1.2.2, where a remote attacker can achieve arbitrary PHP code execution by manipulating a .php filename in a SET GLOBAL general_log_file statement, followed by a SELECT containing the code. The root cause is the combination of allowing an external input to specify ...

CVE-2018-19053

PbootCMS 1.2.2 allows remote attackers to execute arbitrary PHP code by specifying a .php filename in a "SET GLOBAL generallogfile" statement, followed by a SELECT statement containing this PHP code...

CVE-2018-18909

xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view...

PbootCMS SQL Injection Vulnerability (CNVD-2018-21503)

PbootCMS is an open source enterprise building content management system CMS developed using the PHP language. A SQL injection vulnerability exists in the apps\admin\controller\content\SingleController.php file in PbootCMS version 1.2.2-20181012. A remote attacker can exploit this vulnerability t...

org.apache.cxf.fediz.examples:spring2Webapp (>=1.2.0 <=1.2.2), org.apache.cxf.fediz.systests.webapps:fediz-systests-webapps-spring2 (>=1.2.0 <=1.2.2) +1 more potentially affected by CVE-2016-4464 via org.apache.cxf.fediz:fediz-spring2 (>=1.2.0 <=1.2.2)

org.apache.cxf.fediz:fediz-spring2 MAVEN version =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.2 Source cves: CVE-2016-4464 Source advisory: OSV:GHSA-QPWJ-MVV7-V3M9...

org.apache.cxf.fediz.examples:springPreauthWebapp (>=1.2.0 <=1.2.2), org.apache.cxf.fediz.examples:springWebapp (>=1.2.0 <=1.2.2) +3 more potentially affected by CVE-2016-4464 via org.apache.cxf.fediz:fediz-spring (>=1.2.0 <=1.2.2)

org.apache.cxf.fediz:fediz-spring MAVEN version =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.2 Source cves: CVE-2016-4464 Source advisory: OSV:GHSA-QPWJ-MVV7-V3M9...

Open Redirect in st

st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 redirect to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a...

CVE-2018-12689

phpLDAPadmin 1.2.2 allows LDAP injection via a crafted serverid parameter in a cmd.php?cmd=loginform request, or a crafted username and password in the login panel...

Sanitize-html cross-site scripting vulnerability (CNVD-2018-14553)

Sanitize-html is a tool for cleaning up user-submitted HTML. A cross-site scripting vulnerability exists in Sanitize-html 1.2.2 and earlier versions. A remote attacker can inject arbitrary web script or HTML by exploiting this vulnerability...

CVE-2017-16017

sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability...

Fedora 26 : bchunk (2018-d5aa3e1d90)

spec cleanup, silent rpmlint - remove upstreamed patches, fixes rhbz 1507577 - update to 1.2.2 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as...

NetApp AltaVault OST Plugin Information Disclosure Vulnerability

NetApp AltaVault is a cloud storage solution from NetApp, Inc. that features scalability, data encryption, and support for data backup and recovery. The solution features scalability, data encryption, and support for data backup and recovery.OST Plug-in is one of the APIs used to provide backup a...

WordPress Dbox 3D Slider Lite Plugin SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Dbox 3D Slider Lite plugin is used in one of the 3D slider to add plug-ins. A SQL injection vulnerability exists i...

CVE-2018-5374

The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\sliders.php currentsliderid parameter...

AndroidSVG SVG Parsing Component Denial of Service Vulnerability

AndroidSVG is a SVG Scalable Vector Graphics parser and renderer for Android.SVG parsing component is one of the SVG parsing components. A security vulnerability exists in the SVG parsing component in AndroidSVG version 1.2.2. A remote attacker can exploit this vulnerability to cause a denial of...

Remote code execution

AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution...

jwt-scala Cannot Verify Token Signature Vulnerability

jwt-scala is a Scala library for processing JSON Web Token JWT. A security vulnerability exists in jwt-scala 1.2.2 and earlier versions, which stems from the program failing to properly verify token signatures. A remote attacker can exploit the vulnerability to forge a signed token with specially...