GHSA-4662-J96G-MV46 Arbitrary Code Injection in reduce-css-calc

Affected versions of reduce-css-calc pass input directly to eval. If user input is passed into the calc function, this may result in cross-site scripting on the browser, or remote code execution on the server. Proof of Concept const reduceCSSCalc = require'reduce-css-calc';...

WordPress Testimonial Slider plugin <=1.2.4 - Authenticated SQL Injection vulnerability

Authenticated SQL Injection vulnerability found by DefenceCode in WordPress Testimonial Slider plugin versions =1.2.4. Solution Update the WordPress Testimonial Slider plugin to the latest version at least 1.2.5...

WordPress Testimonial Slider plugin <=1.2.4 - Authenticated SQL Injection vulnerability

Authenticated SQL Injection vulnerability found by DefenceCode in WordPress Testimonial Slider plugin versions =1.2.4. Solution Update the WordPress Testimonial Slider plugin to the latest version at least 1.2.5...

CVE-2017-10888

BOOK WALKER for Windows Ver.1.2.9 and earlier, BOOK WALKER for Mac Ver.1.2.5 and earlier allow an attacker to access local files via unspecified vectors...

Design/Logic Flaw

BOOK WALKER for Windows Ver.1.2.9 and earlier, BOOK WALKER for Mac Ver.1.2.5 and earlier allow an attacker to access local files via unspecified vectors...

OpenWebif 'CallOPKG' Function Remote Command Execution Vulnerability

OpenWebif is an open source web interface plug-in for Linux-based set-top boxes. A security vulnerability exists in OpenWebif version 1.2.5, which originates from the failure of the 'CallOPKG' function of the IpkgController class in the plugin/controllers/ipkg.py file to restrict or correctly...

Updated pcmanfm packages fix security vulnerability

PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service application unavailability. CVE-2017-8934...

PCManFM Local Denial of Service Vulnerability

PCManFM is a Chinese programmer Hong Ren Oracle developed a set of open source, free file management software. A local denial of service vulnerability exists in PCManFM version 1.2.5. A local attacker can exploit this vulnerability to cause a denial of service application unavailability...

CVE-2017-8934

PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service application unavailability...

Design/Logic Flaw

PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service application unavailability...

UBUNTU-CVE-2017-8934

PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service application unavailability...

DEBIAN-CVE-2017-8934

PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service application unavailability...

Default credentials

Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin...

DEBIAN-CVE-2017-8114

Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin...

CVE-2017-8114

Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin...

WordPress Easy WP SMTP Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their own websites on servers that support PHP and MySQL databases. WordPress can also be used as a content management system CMS. A cross-site scripting vulnerability exists in WordPress Easy WP SMTP...

CVE-2017-7723

XSS exists in Easy WP SMTP before 1.2.5, a WordPress Plugin, via the e-mail subject or body...

WordPress NewStatPress 1.2.4 Plugin - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Source: https://sumofpwn.nl/advisory/2016/persistentcrosssitescriptinginthewordpressnewstatpressplugin.html Abstract A persistent Cross-Site Scripting XSS vulnerability has been found in the WordPress NewStatPress plugin. By using this...

WordPress Plugin NewStatPress 1.2.4 - Persistent Cross-Site Scripting (XSS) vulnerability

WordPress Plugin NewStatPress 1.2.4 has a persistent Cross-Site Scripting XSS vulnerability discovered on Summer Of Pwnage event Solution Update plugin to the latest version at least 1.2.5...

WordPress Plugin NewStatPress 1.2.4 - Cross-Site Scripting

WordPress Plugin NewStatPress 1.2.4 - Cross-Site Scripting Source: https://sumofpwn.nl/advisory/2016/persistentcrosssitescriptinginthewordpressnewstatpressplugin.html Abstract A persistent Cross-Site Scripting XSS vulnerability has been found in the WordPress NewStatPress plugin. By using this...