CVE-2020-15250

In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this...

CVE-2020-15250

In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this...

Information disclosure

In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this...

CVE-2020-15250 Information disclosure in JUnit4

In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this...

CVE-2020-15250

In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this...

PT-2020-15461 · Jenkins · Jenkins Database Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Database Plugin versions 1.6 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to execute arbitrary SQL scripts because the database console does not require POST requests. This issue enables...

PT-2020-15462 · Jenkins · Jenkins Database Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins database Plugin versions 1.6 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified database server using attacker-specified credentials. The vulnerability affects...

PT-2020-15463 · Jenkins · Jenkins Database Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Database Plugin versions 1.6 and earlier Description: A missing permission check in the Jenkins Database Plugin allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified database server using...

postgresql-jdbc security update

9.2.1002-8 - require explicitly jdk-1.7 due to ABI bytecode compatibility 9.2.1002-7 - fixed XXE vulnerability CVE-2020-13692...

WordPress NexosReal Estate 1.7 Theme - (search_order) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Theme NexosReal Estate 1.7 - 'searchorder' SQL Injection Google Dork: inurl:/wp-content/themes/nexos/ Exploit Author: Vlad Vector Vendor: Sanljiljan https://themeforest.net/user/sanljiljan Software Version: 1.7 Softwar...

CloudBees Jenkins VncViewer Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . VncViewer Plugin is used in which a VNC remo...

CVE-2020-15364

The Nexos theme through 1.7 for WordPress allows top-map/?searchlocation= reflected XSS...

CVE-2020-15364

The CVE-2020-15364 entry corresponds to the Nexos Real Estate WordPress Theme (up to v1.7). Connected sources confirm concrete details: vulnerable components are the frontend endpoints top-map/?search_location= (reflected XSS) and side-map/?search_order= (SQL Injection). Attacker could trigger un...

Easy Transfer 1.7 for iOS - Directory Traversal

Title: Easy Transfer 1.7 for iOS - Directory Traversal Author: Vulnerability Laboratory Date: 2020-04-27 Software: https://apps.apple.com/us/app/easy-transfer-wifi-transfer/id1484667078 CVE: N/A Document Title: =============== Easy Transfer v1.7 iOS - Multiple Web Vulnerabilities References Sourc...

PrestaShop Correos Express Information Disclosure Vulnerability

PrestaShop is a set of open source e-commerce solutions from PrestaShop, USA. The program provides a variety of payment methods , SMS alerts and product image scaling and other features . Correos Express is one of the logistics management plug-ins . A security vulnerability exists in Correos...

CVE-2020-11529

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...

Joomla! SQL Injection Vulnerability (CNVD-2020-21002)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A SQL injection vulnerability exists in Joomla! versions 1.7.0 through 3.9.15, which stems from a lack of validation of externally-entered SQL...

Joomla 1.7.x < 3.9.16 Multiple Vulnerabilities (5783-joomla-3-9-16)

According to its self-reported version, the instance of Joomla! running on the remote web server is 1.7.x prior to 3.9.16. It is, therefore, affected by multiple vulnerabilities. - Missing token checks in the image actions of comtemplates causes CSRF vulnerabilities. CVE-2020-10241 - Inadequate...

VulnCheck KEV: CVE-2018-1000136

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node...

500 Chrome Extensions Caught Stealing Private Data of 1.7 Million Users

Google removed 500 malicious Chrome extensions from its Web Store after they found to inject malicious ads and siphon off user browsing data to servers under the control of attackers. These extensions were part of a malvertising and ad-fraud campaign that's been operating at least since January...