CVE-2020-15152 Server-Side Request Forgery in ftp-srv

ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a...

WordPress Plugin LearnDash LMS 3.1.2 - Reflective Cross-Site Scripting

Exploit Title: LearnDash WordPress LMS Plugin 3.1.2 - Reflective Cross-Site Scripting Date: 2020-01-14 Vendor Homepage: https://www.learndash.com Vendor Changelog: https://learndash.releasenotes.io/release/uCskc-version-312 Exploit Author: Jinson Varghese Behanan Author Advisory:...

WordPress Wordable plugin <= 3.1.1 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by NinTechNet in WordPress Wordable plugin versions = 3.1.1. Solution Update the WordPress Wordable plugin to the latest available version at least 3.1.2...

WordPress LearnDash LMS Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.LearnDash LMS is a learning management system building plugin used in it. A cross-site scripting vulnerability exists i...

PT-2020-19376 · WordPress · Learndash Lms

Name of the Vulnerable Software and Affected Versions: LearnDash LMS plugin versions prior to 3.1.2 Description: The issue allows for XSS via the ld-profile search field. Recommendations: For versions prior to 3.1.2, update to version 3.1.2 or later to resolve the issue...

Design/Logic Flaw

Zanata 3.0.0 through 3.1.2 has RCE due to EL interpolation in logging...

Security Bulletin: A Security Vulnerability affects IBM Cloud Private - Go (CVE-2019-14809)

Summary A Security Vulnerability affects IBM Cloud Private - Go Vulnerability Details CVEID: CVE-2019-14809 DESCRIPTION: Go could allow a remote attacker to bypass security restrictions, caused by improper handling of hosts in URLs. By using a specially-crafted host, an attacker could exploit thi...

CVE-2019-4132

IBM Cloud Automation Manager 3.1.2 could allow a user to be impropertly redirected and obtain sensitive information rather than receive a 404 error message. IBM X-Force ID: 158274...

Information disclosure

IBM Cloud Automation Manager 3.1.2 could allow a user to be impropertly redirected and obtain sensitive information rather than receive a 404 error message. IBM X-Force ID: 158274...

CVE-2019-4132

IBM Cloud Automation Manager 3.1.2 is affected by an improper redirection vulnerability when a bad API path is requested, which could disclose sensitive information instead of returning a 404. The issue is due to redirection instead of proper error handling. Affected product/version: IBM Cloud Au...

WordPress pie-register plugin SQL injection vulnerability

WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. pie-register is a plugin for user registration and login form customization. A SQL injection vulnerability exists in WordPress...

PT-2019-16914 · Ibm · Ibm Cloud Automation Manager

Name of the Vulnerable Software and Affected Versions: IBM Cloud Automation Manager version 3.1.2 Description: The issue allows a malicious user on the client side, with access to the client computer, to run a custom script. Recommendations: For IBM Cloud Automation Manager version 3.1.2, conside...

PT-2019-16913 · Ibm · Ibm Cloud Automation Manager

Name of the Vulnerable Software and Affected Versions: IBM Cloud Automation Manager version 3.1.2 Description: The issue could allow a user to be improperly redirected and obtain sensitive information rather than receive a 404 error message. Recommendations: For IBM Cloud Automation Manager versi...

IBM Cloud Automation Manager Script Injection Vulnerability

IBM Cloud Automation Manager is a multi-cloud self-service management platform from IBM USA. The platform supports the deployment of cloud infrastructure in multiple clouds. A script injection vulnerability exists in IBM Cloud Automation Manager version 3.1.2, which can be exploited by an attacke...

CVE-2019-15659

The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969...

IBM Cloud Automation Manager Redirection Vulnerability

IBM Cloud Automation Manager is a multi-cloud self-service management platform from IBM USA. The platform supports the deployment of cloud infrastructure in multiple clouds. A redirection vulnerability exists in IBM Cloud Automation Manager version 3.1.2. The vulnerability stems from a redirectio...

CVE-2019-4117

IBM Cloud Private is affected by CVE-2019-4117: cross-site request forgery in Identity and Access Management modules for versions 3.1.1 and 3.1.2. The vulnerability enables an attacker to cause unauthorized actions transmitted from a trusted user. IBM’s security bulletin recommends applying patch...

PT-2019-16909 · Ibm · Ibm Cloud Private

Name of the Vulnerable Software and Affected Versions: IBM Cloud Private versions 3.1.1 through 3.1.2 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted sessio...

PT-2019-16906 · Ibm · Ibm Cloud Private

Name of the Vulnerable Software and Affected Versions: IBM Cloud Private versions 3.1.1 through 3.1.2 Description: The issue allows an attacker to execute malicious and unauthorized actions by exploiting cross-site request forgery. This could be done by transmitting actions from a user that the...

Fedora 29 : 3:mariadb / mariadb-connector-c / mariadb-connector-odbc (2019-f873e2799f)

MariaDB 10.3.17 Release notes : https://mariadb.com/kb/en/mariadb-10317-release-notes/ MariaDB Connector/C 3.1.3 Release notes : https://mariadb.com/kb/en/mariadb-connector-c-313-release-notes/ MariaDB Connector/ODBC 3.1.2 Release notes :...