CVE-2024-7762

The Simple Job Board WordPress plugin before 2.12.6 does not prevent uploaded files from being listed, allowing unauthenticated users to access and download uploaded resumes...

WordPress plugin Simple Job Board 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-39326

SkillTree is a micro-learning gamification platform. Prior to version 2.12.6, the endpoint /admin/projects/projectname/skills/skillname/video and probably others is open to a cross-site request forgery CSRF vulnerability. Due to the endpoint being CSRFable e.g POST request, supports a content typ...

CVE-2024-39326 SkillTree CSRF Vulnerability allows an attacker to modify the Video and Captions of a Skill

SkillTree is a micro-learning gamification platform. Prior to version 2.12.6, the endpoint /admin/projects/projectname/skills/skillname/video and probably others is open to a cross-site request forgery CSRF vulnerability. Due to the endpoint being CSRFable e.g POST request, supports a content typ...

PT-2024-28451 · Skilltree · Skilltree

Name of the Vulnerable Software and Affected Versions: SkillTree versions prior to 2.12.6 Description: The issue concerns a cross-site request forgery CSRF vulnerability in the /admin/projects/projectname/skills/skillname/video endpoint, which is open to exploitation due to the lack of CSRF...

SkillTree Security Vulnerabilities

SkillTree is a micro-learning gamification platform open-sourced by the National Security Agency. Provides out-of-the-box UI visualization, a convenient client integration library, and a dashboard for managing the creation and management of gamified training profiles. A security vulnerability...

GHSA-3X8X-79M2-3W2W jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode

jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service 2 GB transient heap usage per read in uncommon situations involving JsonNode JDK serialization...

FasterXML jackson-databind 安全漏洞

FasterXML jackson-databind is FasterXML company based on a JAVA can be XML and JSON and other data formats and JAVA objects for the conversion of the library . Jackson can be easily converted into Java objects and json objects and xml documents , the same can be json, xml conversion into Java...

CVE-2022-31039

Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room's settings. This issue has been patched in...

Design/Logic Flaw

Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room's settings. This issue has been patched in...

CVE-2022-31039 Improper privilege management - Anyone can view room settings in GreenLight

Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room's settings. This issue has been patched in...

CVE-2022-31039 Improper privilege management - Anyone can view room settings in GreenLight

Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room's settings. This issue has been patched in...

PT-2021-7982

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.10.x through 2.12.x before 2.12.6 jackson-databind versions 2.13.x before 2.13.1 Bitbucket Data Center and Server versions 7.17.0, 7.21.0, 8.7.0, 8.8.0, 8.9.0, 8.10.0, 8.11.0, 8.12.0, and 8.13.0 Bamboo Data Center a...

Vulnerability fixed in Icinga

A vulnerability has been fixed in Icinga. Within Icinga TLS certificate verification is used. However However, the validity of the Certificate Authority is not checked. A malicious party can thus circumvent bypass security. Updates have been released to fix the vulnerabilities. More information c...

CVE-2019-7249

In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one user of the system who didn't have root access to tamper with another's installs...

EC-CUBE 2.12.6 - Server-Side Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: EC-CUBE 2.12.6 Server-Side Request Forgery Date: 22/10/16 Exploit Author: Wad Deek Vendor Homepage: http://en.ec-cube.net/ Software Link: http://en.ec-cube.net/download/ Version: 2.12.6en-p1 Tested on: Xampp on Windows7 Fuzzing...

EC-CUBE 2.12.6 - Server-Side Request Forgery

EC-CUBE 2.12.6 - Server-Side Request Forgery Exploit Title: EC-CUBE 2.12.6 Server-Side Request Forgery Date: 22/10/16 Exploit Author: Wad Deek Vendor Homepage: http://en.ec-cube.net/ Software Link: http://en.ec-cube.net/download/ Version: 2.12.6en-p1 Tested on: Xampp on Windows7 Fuzzing tool:...

EC-CUBE 2.12.6 Server-Side Request Forgery

Exploit Title: EC-CUBE 2.12.6 Server-Side Request Forgery Date: 22/10/16 Exploit Author: Wad Deek Vendor Homepage: http://en.ec-cube.net/ Software Link: http://en.ec-cube.net/download/ Version: 2.12.6en-p1 Tested on: Xampp on Windows7 Fuzzing tool:...

EC-CUBE 2.12.6 - Server-Side Request Forgery

Exploit Title: EC-CUBE 2.12.6 Server-Side Request Forgery Date: 22/10/16 Exploit Author: Wad Deek Vendor Homepage: http://en.ec-cube.net/ Software Link: http://en.ec-cube.net/download/ Version: 2.12.6en-p1 Tested on: Xampp on Windows7 Fuzzing tool:...

Debian Security Advisory DSA 2836-1 (devscripts - arbitrary code execution)

Several vulnerabilities have been discovered in uscan, a tool to scan upstream sites for new releases of packages, which is part of the devscripts package. An attacker controlling a website from which uscan would attempt to download a source tarball could execute arbitrary code with the privilege...