CVE-2018-11734

In e107 v2.1.7, output without filtering results in XSS...

Social Media & Share Icons <= 2.1.7 - Multiple Issues

The Social Media Share Buttons & Social Sharing Icons WordPress plugin was affected by a Multiple Issues security vulnerability. https://plugins.trac.wordpress.org/browser/ultimate-social-media-icons/tags/2.1.7/libs/controllers/sfsibuttonscontroller.phpL877...

IBM i2 Enterprise Insight Analysis Information Disclosure Vulnerability (CNVD-2018-26230)

IBM i2 Enterprise Insight Analysis is a suite of data analytics and integration solutions from IBM USA. The product is characterized by interoperability and scalability. An information disclosure vulnerability exists in IBM i2 Enterprise Insight Analysis version 2.1.7, which originates when a...

Information disclosure

IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM...

CVE-2018-1525

IBM i2 Enterprise Insight Analysis 2.1.7 is affected by a vulnerability where HTTP Strict Transport Security was not properly enabled, enabling potential information disclosure via man-in-the-middle attacks. The IBM bulletin indicates the issue lies in missing secure headers and notes an upgrade ...

CVE-2018-1504

CVE-2018-1504 affects IBM i2 Enterprise Insight Analysis 2.1.7. A remote attacker could persuade a victim to visit a malicious site to hijack the victim’s click actions (clickjacking), potentially enabling further attacks. The provided documents do not include explicit exploit details or a confir...

[SECURITY] [DLA 1499-1] discount security update

Package : discount Version : 2.1.7-1+deb8u1 CVE ID : CVE-2018-11468 CVE-2018-11503 CVE-2018-11504 CVE-2018-12495 Debian Bug : 901912 Several heap-based buffer over-reads were found in discount, an implementation of the Markdown markup language in C, that allowed remote attackers to cause a...

e107 Cross-Site Request Forgery Vulnerability (CNVD-2018-09821)

e107 is an open source, free and PHP and MySQL based Content Management System CMS developed by the e107 team. The system supports a variety of plug-ins and appearance of the theme , can be used as a personal blog , discussion community , archive repository and so on. A cross-site request forgery...

CVE-2018-11127

e107 2.1.7 has CSRF resulting in arbitrary user deletion...

Cross site request forgery (csrf)

e107 2.1.7 has CSRF resulting in arbitrary user deletion...

CVE-2018-11127

e107 2.1.7 has CSRF resulting in arbitrary user deletion...

CVE-2018-11127

CVE-2018-11127 pertains to the e107 CMS, targetting version 2.1.7. The issue is a Cross-Site Request Forgery (CSRF) that allows arbitrary user deletion. Root cause and impact are documented across multiple sources (including Red Hat and CNVD). According to CVSS, the vulnerability is network-expos...

Navarino Infinity Session Fixation Vulnerability

Navarino Infinity is a maritime bandwidth management and optimization solution from Navarino Greece. The solution can be used to equip many types of vessels. A session fixation vulnerability exists in Navarino Infinity version 2.1.7. A remote attacker can exploit this vulnerability to hijack...

WordPress booking-calendar plugin cross-site request forgery vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. booking-calendar plugin is used in one of the online booking plugin. A cross-site request forgery vulnerability...

WordPress booking-calendar plugin cross-site scripting vulnerability (CNVD-2018-01252)

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. booking-calendar plugin is used in one of the online booking plugin. A cross-site scripting vulnerability exists ...

WordPress booking-calendar plugin cross-site scripting vulnerability (CNVD-2018-01251)

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. booking-calendar plugin is used in one of the online booking plugin. A cross-site scripting vulnerability exists ...

WordPress booking-calendar plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. booking-calendar plugin is used in one of the online booking plugin. A cross-site scripting vulnerability exists ...

PT-2017-15534

Name of the Vulnerable Software and Affected Versions mbed TLS versions prior to 1.3.19 mbed TLS versions 2.x prior to 2.1.7 mbed TLS versions 2.4.x prior to 2.4.2 Description A specially crafted x509 certificate can cause an invalid free of a stack pointer when parsed by the mbed TLS library,...

JVN#92520335: eXtplorer vulnerable to cross-site request forgery

eXtplorer is a web-based file manager. index.php of eXtplorer contains a cross-site request forgery CWE-352 vulnerability. Impact If a user views a malicious page while logged in, the user may be forced to implicitly perform unintended operations such as the execution of arbitrary PHP code...

WordPress NextGEN Gallery plugin 'dir' parameter directory traversal vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.NextGEN Gallery is a WordPress gallery plugin. A directory traversal vulnerability exists in the NextGEN Gallery...