67 matches found
CVE-2022-2405 WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion
The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup...
CVE-2022-2405
CVE-2022-2405 affects the WordPress WP Popup Builder plugin (versions prior to 1.2.9). The flaw is an authorization and CSRF weakness in an AJAX action, enabling any authenticated user (e.g., subscribers) to delete arbitrary popups. Affected component is the plugin’s AJAX endpoint lacking proper ...
CVE-2022-2405 WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion
The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup...
CVE-2021-2405
CVE-2021-2405 affects Oracle E-Business Suite, specifically the Oracle Engineering component (Change Management). Affected versions are 12.2.3–12.2.10. The vulnerability allows a low-privilege, unauthenticated attacker with HTTP network access to compromise Oracle Engineering, potentially causing...
RHEL 7 : dhcp (RHSA-2021:2405)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2405 advisory. The Dynamic Host Configuration Protocol DHCP is a protocol that allows individual devices on an IP network to get their own network configuration...
SUSE: Security Advisory (SUSE-SU-2020:2405-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE SLES12 Security Update : php72 (SUSE-SU-2020:2405-1)
This update for php72 fixes the following issues : CVE-2020-7068: Use of freed hash key in the pharparsezipfile function bsc1175223. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically...
RHEL 7 : freerdp (RHSA-2020:2405)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2405 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP server...
PRODSECBUG-2405: Injection vulnerability via email templates
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
RHEL 8 : kernel-rt (RHSA-2019:2405)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2405 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...
CVE-2019-2405
Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Security. Supported versions that are affected are 8.55, 8.56 and 8.57. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise...
CVE-2019-2405
CVE-2019-2405 affects Oracle PeopleSoft Enterprise PeopleTools (Security subcomponent) with affected versions 8.55, 8.56, and 8.57. The vulnerability is described as difficult to exploit and can be triggered by a low-privileged attacker who can access the system over HTTP, potentially allowing ta...
CVE-2018-2405
SAP Solution Manager, Incident Management Work Center, versions 7.10 and 7.20, is vulnerable to a cross-site scripting flaw caused by insufficient filtering when uploading an attachment. An attacker could upload a malicious script as an attachment and have it execute in a user’s browser. Root cau...
CVE-2018-2405
SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this could lead to possible Cross-Site Scripting...
CVE-2015-2405
CVE-2015-2405 is rejected/not used per the initial description.
CVE-2017-2405
The CVE-2017-2405 entry concerns WebKit Web Inspector in WebKit used by Apple Safari and iOS. A memory-corruption vulnerability could allow remote code execution or a denial of service via a crafted web page. Affected products include iOS prior to 10.3 and Safari prior to 10.1. Apple addresses th...
CVE-2017-2405
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit Web Inspector" component. It allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a...
SUSE SLES11 Security Update : bind (SUSE-SU-2016:2405-1)
The nameserver bind was updated to fix a remote denial of service vulnerability, where a crafted packet could cause the nameserver to abort. CVE-2016-2776, bsc1000362 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable...
CVE-2016-2405
CVE-2016-2405 affects Huawei Policy Center software prior to V100R003C10SPC020. A remote authenticated attacker can escalate privileges by crafting a URL, obtaining admin rights and causing a denial of service (system crash). The vulnerability is described in Huawei PSIRT advisory HWPSIRT-2015-12...