Huawei EulerOS: Security Advisory for ghostscript (EulerOS-SA-2019-1202)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2019-1211)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for ntp (EulerOS-SA-2019-1213)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2019-1201)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress ListingPro premium theme <= 2.5.3 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress ListingPro premium theme versions = 2.5.3. Solution Update the WordPress ListingPro premium theme to the latest available version at least 2.5.4...

Pannellum Cross-Site Scripting Vulnerability

Pannellum is a lightweight open source web-based panoramic viewer. A cross-site scripting vulnerability exists in Pannellum versions 2.5.0 through 2.5.4. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability ...

WordPress option-tree plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. option-tree is used in one of the theme selection building plugin. A cross-site scripting vulnerability exists in WordPress...

PT-2019-7279 · WordPress · Option-Tree

Name of the Vulnerable Software and Affected Versions: option-tree plugin versions prior to 2.5.4 Description: The issue is related to a Cross-Site Scripting XSS problem in the add query arg function. Recommendations: For versions prior to 2.5.4, update to version 2.5.4 or later to resolve the...

CVE-2018-17870

An issue was discovered in BTITeam XBTIT 2.5.4. The "returnto" parameter of accountchange.php is vulnerable to an open redirect, a different vulnerability than CVE-2018-15683...

CVE-2018-17870

An issue was discovered in BTITeam XBTIT 2.5.4. The "returnto" parameter of accountchange.php is vulnerable to an open redirect, a different vulnerability than CVE-2018-15683...

CVE-2018-16361

An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter...

CVE-2018-15679

An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?page=forums&action=search is vulnerable to reflected cross-site scripting...

Cross site scripting

An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting...

Cross site request forgery (csrf)

The newsfeed aka /index.php?page=viewnews in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is also exploitable via CSRF...

CVE-2018-15681

An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie, which is not flagged as HTTPOnly. Due to the weak and predictable salt that is in place, an attacker who successfully steals this cookie c...

CVE-2018-16361

An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter...

CVE-2018-15677

BTITeam XBTIT 2.5.4 contains a stored cross-site scripting (XSS) vulnerability in the newsfeed page (/index.php?page=viewnews) where the news item title is not correctly sanitized. The issue can be triggered via standard XSS and is also exploitable through CSRF. The root cause is the failure to p...

CVE-2018-15681

CVE-2018-15681 affects BTITeam XBTIT 2.5.4. The issue: on login, the user’s password hash is rehashed with a weak, predictable salt and stored in a cookie named “pass” that is not HTTPOnly. An attacker who steals this cookie can brute-force the hash to recover the cleartext password. Publicly doc...

CVE-2018-15680

CVE-2018-15680 affects BTITeam XBTIT 2.5.4 where passwords in the xbtit_users table are stored as unsalted MD5 hashes. The root cause is weak password hashing, enabling context-dependent attackers to brute-force and recover cleartext passwords. Public details in the provided documents confirm the...

CVE-2018-15678

BTITeam XBTIT 2.5.4 contains a reflected cross-site scripting (XSS) vulnerability in the sign-up page ( /index.php?page=signup ) via the act parameter. The NVD entry CVE-2018-15678 documents this issue with CVSS v2 base score 4.3 ( MEDIUM ) and CVSS v3 base score 6.1 ( MEDIUM ), indicating networ...