627 matches found
Cross site request forgery (csrf)
FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page...
CVE-2019-15229
FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page...
FUEL CMS Cross-Site Scripting Vulnerability (CNVD-2019-41832)
FUEL CMS is a content management system CMS based on the Codelgniter framework. A cross-site scripting vulnerability exists in the Create Blocks section of the Admin console in FUEL CMS version 1.4.4, which stems from a lack of proper validation of client-side data in the WEB application and can ...
Security Bulletin: Security vulnerability affects IBM Cloud Object Storage SDK NodeJS (Mar 2019)
Summary Security vulnerability affects IBM Cloud Object Storage SDK NodeJS. This vulnerability has been addressed in the latest SDK NodeJS release. Vulnerability Details CVE-ID: CVE-2018-16487 Description: Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution...
WPS Cleaner <= 1.4.4 - Multiple Issues
CSRF, Media Dislcosure...
CVE-2019-9764
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verifyserverhostname were set to false, even when it is actually set to true. This is fixed in 1.4.4...
UBUNTU-CVE-2019-9764
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verifyserverhostname were set to false, even when it is actually set to true. This is fixed in 1.4.4...
PT-2019-19855 · Hashicorp +1 · Hashicorp Consul +1
Name of the Vulnerable Software and Affected Versions: HashiCorp Consul version 1.4.3 Description: The issue arises from a lack of server hostname verification for agent-to-agent TLS communication in HashiCorp Consul. This occurs even when the verify server hostname setting is set to true, causin...
UBUNTU-CVE-2018-1000888
PEAR ArchiveTar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the ArchiveTar class. There are several file operations with $vheader'filename' as parameter such as fileexists, isfile, isdir, etc. When extract is called without a specific prefix path, we can trigger...
Nginx < 1.4.4 ngx_parse_http Security Bypass
According to the self-reported version in the Server response header, the installed version of nginx is greater than 0.8.41 but prior to 1.4.4 / 1.5.7. It is, therefore, affected by a security bypass vulnerability in 'ngxhttpparse.c' when a file with a space at the end of the URI is requested. No...
CVE-2017-6929
A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal...
Elastic Logstash 'CVE-2015-5378' Man in the Middle Security Bypass Vulnerability - Linux
Elastic Logstash is prone to a security bypass vulnerability. This VT has been deprecated and merged into the VT VT SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
CVE-2018-0506
Nootka 1.4.4 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...
Nootka Command Injection Vulnerability
Nootka is a mobile application for learning classical music notation. A security vulnerability exists in Nootka 1.4.4 and earlier versions. A remote attacker can exploit the vulnerability to execute arbitrary operating system commands...
JVN#10103841: Nootka App for Android vulnerable to OS command injection
Nootka App for Android provided by SeeLook contains an OS command injection vulnerability CWE-78. Impact A remote attacker may execute an arbitrary OS command. Solution Update the Application Update to the latest version according to the information provided by the developer. Products Affected...
Foreman Cross-Site Scripting Vulnerability (CNVD-2017-34618)
Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A cross-site scripting vulnerability exists in the search auto-completion feature in Foreman versions...
PT-2017-5778 · Foreman · Foreman
Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.4.4 Description: A cross-site scripting XSS issue exists in the search auto-completion functionality, allowing remote authenticated users to inject arbitrary web script or HTML via a crafted key name...
rkhunter Remote Code Execution Vulnerability
rkhunter is a Unix-based scanning tool. The tool is used to scan for rootkits, backdoor programs, and other local vulnerabilities. A security vulnerability exists in versions of rkhunter prior to 1.4.4. A remote attacker can exploit this vulnerability to execute arbitrary code...