UserPro <= 4.9.23 - Unauthenticated Cross-Site Scripting (XSS)

An XSS vulnerability that affects from version 2.13 to 4.9.23. PoC POST /wp-admin/admin-ajax.php Host: domain.com action=userproshortcodetemplate=userpro id=1 layout="float" collageperpage="20" emdpaginatetop="1" emdpaginate="1" emdgender="Gender,radi...

Git for Windows 2.13.x < 2.13.7 / 2.14.x < 2.14.4 / 2.15.x < 2.15.2 / 2.16.x < 2.16.4 / 2.17.x < 2.17.1 Remote Code Execution

The version of Git for Windows installed on the remote host is 2.13.x prior to 2.13.7, 2.14.x prior to 2.14.4, 2.15.x prior to 2.15.2, 2.16.x prior to 2.16.4 or 2.17.x prior to 2.17.1. It is, therefore, affected by a remote code execution vulnerability. C Tenable Network Security, Inc...

CVE-2018-10254

CVE-2018-10254 affects Netwide Assembler (NASM) 2.13, with a stack-based buffer over-read in the disasm/disasm.c file. The NVD description states that a crafted ELF file could be used by an attacker to cause a denial of service and potentially other impact. Connected Nessus/OpenVAS entries corrob...

CVE-2018-10254

Netwide Assembler NASM 2.13 has a stack-based buffer over-read in the disasm function of the disasm/disasm.c file. Remote attackers could leverage this vulnerability to cause a denial of service or possibly have unspecified other impact via a crafted ELF file...

[SECURITY] [DLA 1038-1] libtasn1-3 security update

Package : libtasn1-3 Version : 2.13-2+deb7u5 CVE ID : CVE-2017-10790 CVE-2017-10790 The asn1checkidentifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1node structure. It may le...

VICIdial 2.9 RC 1 &lt; 2.13 RC1 - &#039;user_authorization&#039; Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VICIdial userauthorization Unauthenticated Command Execution', 'Description' = %q This module exploits a vulnerability in VICIdial versions 2.9 R...

Multiple Security Bypass Vulnerabilities in File-Path Module

File-Path is a module for creating and removing directory trees. A security vulnerability exists in the 'removetree' and 'rmtree' functions in versions of the File-Path module prior to 2.13. An attacker can exploit this vulnerability to set the mode of arbitrary files...

Fedora 24 : 1:links (2016-ea3b7e6556)

Update to version 2.13. Fixes a security issue with the anonymous instances. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

[SECURITY] Fedora 25 Update: links-2.13-1.fc25

Links is a web browser capable of running in either graphics or text mode. It provides a pull-down menu system, renders complex pages, has partial HTML 4.0 support including tables, frames and support for multiple character se ts and UTF-8, supports color and monochrome terminals and allows...

CVE-2016-6801

Cross-site request forgery CSRF vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the...

CVE-2016-1180

Cross-site scripting XSS vulnerability in the Cyber-Will Social-button Premium plugin before 1.1 for EC-CUBE 2.13.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-1180

The CVE-2016-1180 issue concerns the Cyber-Will EC-CUBE Social-button Premium plugin. A cross-site scripting (XSS) vulnerability exists in the Social-button Premium plugin before version 1.1 for EC-CUBE 2.13.x, allowing remote attackers to inject arbitrary web script or HTML via unspecified vecto...

Fedora 21 : s3ql-2.13-1.fc21 (2015-10884)

Update to 2.13 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Network...

The vulnerability of the Red Hat Enterprise Linux operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the util-linux-2.13 package on the Red Hat Enterprise Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited locally...

CVE-2015-1318

The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace container...

ScareCrow 2.13 profile.cgi user Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/15915/info ScareCrow is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have...

ScareCrow 2.13 forum.cgi forum Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/15915/info ScareCrow is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have...

ScareCrow 2.13 post.cgi forum Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/15915/info ScareCrow is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have...

CVE-2013-3938

Integer overflow in xnview.exe in XnView 2.13 allows remote attackers to execute arbitrary code via a large NUMELEMENTS field in an IFDENTRY structure in a JXR file, which triggers a heap-based buffer overflow...

CVE-2012-4192

Mozilla Firefox 16.0, Thunderbird 16.0, and SeaMonkey 2.13 allow remote attackers to bypass the Same Origin Policy and read the properties of a Location object via a crafted web site, a related issue to CVE-2012-4193...