CVE-2019-13363

admin.php?page=notificationbymail in Piwigo 2.9.5 has XSS via the nbmsendhtmlmail, nbmsendmailas, nbmsenddetailedcontent, nbmcomplementarymailcontent, nbmsendrecentpostdates, or paramsubmit parameter. This is exploitable via CSRF...

PT-2019-13293 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo version 2.9.5 Description: The issue concerns a Cross-Site Scripting XSS exploit in the admin.php?page=notification by mail endpoint. This exploit is achievable through several parameters: nbm send html mail, nbm send mail as, nbm send...

CVE-2017-15412

Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

PT-2018-2773

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.0.0 through 2.9.5 Description The issue is related to the shortcomings of the deserialization mechanism in the jackson-databind library. Exploitation of this issue may allow a remote attacker to impact the...

FasterXML Jackson-databind Code Execution Vulnerability

FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . Jackson-databind is one of the components with data binding capabilities . A security vulnerability exists in FasterXML jackson-databind versions prior to 2.8.11.1 and 2.9.x prior to 2.9.5. A remote attacker can send...

Smart Shoutbox, 2.9.5, SQL Injection

Smart Shoutbox by thekrotek.com, version 2.9.5 and previous, SQL Injection resolution: update to 3.0.0, version released July 2017 update notice: so far the developer has not made an update notice making clear that this was a security release The developer says "Version 3.0 is an absolutely new...

UBUNTU-CVE-2017-16932

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities...

[SECURITY] Fedora 25 Update: git-2.9.5-1.fc25

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The git rpm installs common set of tools which are usually using with small amount of dependencies. To install all git packages,...

PT-2017-4061

Name of the Vulnerable Software and Affected Versions jackson-databind versions prior to 2.6.7.1 jackson-databind versions prior to 2.7.9.1 jackson-databind versions prior to 2.8.9 jackson-databind versions 2.0.0 through 2.9.5 Description A deserialization flaw in the jackson-databind library is...

Atlassian Crowd LDAP Java Object Injection Vulnerability (CWD-4790)

Atlassian Crowd is prone to a LDAP Java object injection vulnerability. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

GNU GTypist 2.9.5-2 - Local Buffer Overflow

Exploit developed using Exploit Pack v6.5 Exploit Author: Juan Sacco - http://www.exploitpack.com - [email protected] Program affected: GNU Typist Affected value: ARG0 Version: 2.9.5-2 Tested and developed under: Kali Linux 2.0 x86 - https://www.kali.org Program description: Simple ncurses...

DEBIAN-CVE-2016-4658

xpointer.c in libxml2 before 2.9.5 as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service use-after-free an...

CVE-2016-2190

Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log...

CVE-2016-2154

Moodle’s Event Monitor (admin/tool/monitor/lib.php) in versions 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not honor moodle/course:viewhiddencourses, allowing remote authenticated users to discover hidden course names by subscribing to a rule. Impact is partial confident...

The Gazette Edition Cross Site Scripting

Hello list! I want to warn you about Cross-Site Scripting, Full path disclosure, Abuse of Functionality and Denial of Service vulnerabilities in The Gazette Edition theme for WordPress. It's commercial theme for WP by WooThemes. ------------------------- Affected products: -----------------------...

Debian Security Advisory DSA 1739-1 (mldonkey)

The remote host is missing an update to mldonkey announced via advisory DSA 1739-1. OpenVAS Vulnerability Test $Id: deb17391.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1739-1 mldonkey Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

[Kurdish Security # 5] phpRaid Remote File Include [SMF]

Kurdish Security Advisory phpRaid Remote File Include SMF : "Sosyalizim'de srar insan olmakta srardr" Abdullah Ocalan Contact : irc.gigachat.net kurdhack & www.PatrioticHackers.com & [email protected] Risk : High Class : Remote Script : phpRaid Script Website : http://www.spiffyjr.com Version :...

CVE-2006-0575

convert-fcrontab in Fcron 2.9.5 and 3.0.0 allows remote attackers to create or overwrite arbitrary files via ".." sequences and a symlink attack on the temporary file that is used during conversion...

Design/Logic Flaw

convert-fcrontab in Fcron 2.9.5 and 3.0.0 allows remote attackers to create or overwrite arbitrary files via ".." sequences and a symlink attack on the temporary file that is used during conversion...