Security Bulletin: Input Validation Vulnerability in Watson Studio Local

Summary A lack of input validation offered an attack vector in several API calls. This vulnerability is addressed Vulnerability Details Third Party Entry: PSIRT-ADV0011811 DESCRIPTION: CVSS Base score: 8.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products and Versions...

Denial of service

konversation before 1.2.3 allows attackers to cause a denial of service...

CVE-2009-5050

konversation before 1.2.3 allows attackers to cause a denial of service...

Prototype Pollution

Overview Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument...

WordPress wp-rollback plugin cross-site request forgery vulnerability

WordPress is a set of blogging platform developed by WordPress Foundation using PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wp-rollback is a version rollback plugin used in it, which is mainly used for version rollback of WordPress and its plugins....

CVE-2019-13506

CVE-2019-13506 affects @nuxt/devalue before 1.2.3 (used in Nuxt.js before 2.6.2). The root cause is mishandling of object keys, leading to Cross-Site Scripting (XSS). Impact: potential XSS via object keys in affected builds; CVSS ~6.1 (NVD v3). Mitigation: upgrade to @nuxt/devalue 1.2.3 or later ...

CVE-2019-13506

@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS...

CVE-2018-17398

SQL Injection exists in the AMGallery 1.2.3 component for Joomla! via the filtercategoryid parameter...

Security Bulletin: Vulnerability in IBM Java Runtime affects IBM Network Performance Insight

Summary There is a vulnerability in IBM® Runtime Environment Java™ Version IBM JRE 8.0.5.27 that is used by IBM® Network Performance Insight. IBM® Network Performance Insight has addressed the applicable CVE. Vulnerability Details If you run your own Java code by using the IBM Java Runtime that i...

Cacti < 1.2.3 XSS Vulnerability - Windows

Cacti is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross site scripting

In clearFilter in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string SNMP Options in the View poller cache, leading to XSS...

Synology File Station Information Disclosure Vulnerability

Synology File Station is a set of file management tools from Synology Inc. of Taiwan, China. The tool enables users to access files on Synology NAS devices via the Web. An information disclosure vulnerability exists in SYNO.FolderSharing.List in Synology File Station versions prior to 1.2.3-0252...

CVE-2018-13298

Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors...

Joomla! Easy Shop 1.2.3 Local File Inclusion

Exploit Title: Joomla! Component Easy Shop 1.2.3 - Local File Inclusion Dork: N/A Date: 2019-01-22 Exploit Author: Ihsan Sencan Vendor Homepage: https://joomtech.net/ Software D.: https://www.joomtech.net/products/easyshop?task=file.download&key=7bafaa65995fb3b1383328105df1e10f Software Link:...

Joomla! Component Easy Shop 1.2.3 - Local File Inclusion

Joomla! Component Easy Shop 1.2.3 - Local File Inclusion Exploit Title: Joomla! Component Easy Shop 1.2.3 - Local File Inclusion Dork: N/A Date: 2019-01-22 Exploit Author: Ihsan Sencan Vendor Homepage: https://joomtech.net/ Software D.:...

Joomla! Component Easy Shop 1.2.3 - Local File Inclusion

Exploit Title: Joomla! Component Easy Shop 1.2.3 - Local File Inclusion Dork: N/A Date: 2019-01-22 Exploit Author: Ihsan Sencan Vendor Homepage: https://joomtech.net/ Software D.: https://www.joomtech.net/products/easyshop?task=file.download&key=7bafaa65995fb3b1383328105df1e10f Software Link:...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Network Performance Insight

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version IBM JRE 8.0.2.10 used by IBM Network Performance Insight. IBM Network Performance Insight has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivere...

Cross-Site Scripting in sanitize-html

Affected versions of sanitize-html are vulnerable to cross-site scripting. Proof of Concept: produces the following: This is definitely invalid HTML, but would suggest that it's being interpreted incorrectly by the parser. Recommendation Update to version 1.2.3 or later...

WordPress Support Board Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Support Board Plugin is used in one of the online customer service chat plugin. A cross-site scripting vulnerabili...

GHSA-QPWJ-MVV7-V3M9 High severity vulnerability that affects org.apache.cxf.fediz:fediz-spring and org.apache.cxf.fediz:fediz-spring2

The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token...