229 matches found
CVE-2020-1756
CVE-2020-1756 affects Moodle prior to 3.8.2, 3.7.5, 3.6.9 and 3.5.11, where insufficient input escaping was applied to the PHP unit webrunner admin tool. Root cause: inadequate escaping in the webrunner admin tool. Consequence per sources: potential impact on confidentiality, integrity, and avail...
CVE-2022-1756
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $SERVER'REQUESTURI' before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as...
CVE-2022-1756 Newsletter < 7.4.5 - Reflected Cross-Site Scripting
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $SERVER'REQUESTURI' before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as...
CVE-2022-1756
The Newsletter WordPress plugin before 7.4.5 is affected by a Reflected XSS vulnerability: it fails to sanitize/escape $_SERVER['REQUEST_URI'] when echoing data on admin pages. This can allow injection of malicious scripts in certain requests, with impact limited to client-side script execution i...
AlmaLinux 8 : qt5-qtbase (ALSA-2021:1756)
The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2021:1756 advisory. - An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. readxbmbody in gui/image/qxbmhandler.cpp has a buffer over-read...
Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules Missing Authentication For Critical Function (CVE-2018-17924)
Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote threat actor could send a CIP connection request to an affected device, and upon successful connection, send a new IP configuration to the affected device even if the controller...
Rockwell Automation 1756 Incorrect Authorization (CVE-2010-2965)
The WDB target agent debug service in Wind River VxWorks 6.x, 5.x, and earlier, as used on the Rockwell Automation 1756-ENBT series A with firmware 3.2.6 and 3.6.1 and other products, allows remote attackers to read or modify arbitrary memory locations, perform function calls, or manage tasks via...
Rockwell Automation ControlLogix controllers Exposure of Sensitive Information to an Unauthorized Actor (CVE-2012-6441)
Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules allow remote attackers to obtain sensitive information via a crafted CIP packet. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...
Oracle Linux 8 : qt5-qtbase (ELSA-2021-1756)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1756 advisory. 5.12.5-8 - Build against system xkb and openssl 1.1 Resolves: bz1882375 5.12.5-7 - Fix buffer overflow in XBM parser Resolves: bz1870364 Tenable has extracted t...
RHEL 8 : qt5-qtbase (RHSA-2021:1756)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1756 advisory. Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security...
CentOS 8 : qt5-qtbase (CESA-2021:1756)
The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1756 advisory. - qt: buffer over-read in readxbmbody in gui/image/qxbmhandler.cpp CVE-2020-17507 Note that Nessus has not tested for this issue but has instead relied only on...
CVE-2021-1756
CVE-2021-1756 is an iOS/iPadOS vulnerability described as a lock screen issue that could allow access to private contacts on a device with physical access. The root cause relates to state management around contact handling on the lock screen; Apple fixed it in iOS 14.4 / iPadOS 14.4. The CVE is l...
Oracle MySQL Server 5.5.x <= 5.5.23 Security Update (cpujul2012) - Linux
Oracle MySQL Server is prone to multiple unspecified vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Rockwell Automation Allen-Bradley 1756-EN2T/D Has Denial of Service Vulnerability
Rockwell Automation, Inc. is the world's largest company dedicated to industrial automation and information, helping customers improve productivity, and a sustainable world. A denial of service vulnerability exists in the Rockwell Automation Allen-Bradley 1756-EN2T/D. An attacker could exploit th...
Rockwellautomation Controllogix Unspecified Vulnerability
Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and...
Rockwellautomation Micrologix Missing Authentication for Critical Function
Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote threat actor could send a CIP connection request to an affected device, and upon successful connection, send a new IP configuration to the affected device even if the controller...
IBM Identity Governance and Intelligence SQL Injection (CVE-2018-1756)
An SQL injection vulnerability exists in IBM Identity Governance and Intelligence. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the affected system...
Rockwell Automation/Allen-Bradley 1756-EN2TP Ethernet/IP Communication Interface
Binary data 751061.prm...