407 matches found
UPDATE: Empire 3.2.3
Empire 3.2.3 was released a couple of days ago! If you remember, I briefly mentioned about this tool in my five month old post titled - List of Open Source C2 Post-Exploitation Frameworks. This version adds MITRE ATT&CK technique tagging among other new features. What is Empire? Empire 3.0 is an...
Wireshark Security Update (wnpa-sec-2020-08) - Windows
Wireshark is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"...
Wireshark 3.2.x < 3.2.3 A Vulnerability (macOS)
The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 3.2.3. It is, therefore, affected by a vulnerability as referenced in the wireshark-3.2.3 advisory. - In Wireshark 3.2.0 to 3.2.2, 3.0.0 to 3.0.9, and 2.6.0 to 2.6.15, the BACapp dissector could crash. This was...
WordPress Rencontre – Dating Site plugin <= 3.2.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities
Multiple Cross-Site Request Forgery CSRF vulnerabilities found in WordPress Rencontre – Dating Site plugin versions = 3.2.2. Solution Update the WordPress Rencontre – Dating Site plugin to the latest available version at least 3.2.3...
DEBIAN-CVE-2018-1311
The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via...
Duplicate Post <= 3.2.3 - Authenticated Stored Cross-Site Scripting (XSS)
The Duplicate Post plugin was vulnerable to Authenticated Stored Cross-Site Scripting XSS. However, the POST request had a CSRF nonce that was verified, and no user's without the unfilteredhtml capability, such as Author or Subscriber, were able to access the affected Duplicate Post settings page...
CVE-2018-21014
The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS...
CVE-2012-6714
The count-per-day plugin before 3.2.3 for WordPress has XSS via search words...
PT-2019-11722 · Jenkins · Jenkins Artifactory Plugin
Name of the Vulnerable Software and Affected Versions: Jenkins Artifactory Plugin versions 3.2.2 and earlier Description: A cross-site request forgery issue allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturin...
phpBB 3.2.3 - Remote Code Execution Exploit
Exploit for php platform in category web applications phpBB 3.2.3 - Remote Code Execution Exploit // All greets goes to RIPS Tech // Run this JS on Attachment Settings ACP page var pluploadsalt = ''; var formtoken = ''; var creationtime = ''; var filepath =...
phpBB 3.2.3 Remote Code Execution
// All greets goes to RIPS Tech // Run this JS on Attachment Settings ACP page var pluploadsalt = ''; var formtoken = ''; var creationtime = ''; var filepath = 'phar://./../files/plupload/$saltaaae9cba5fdadb1f0c384934cd20d11czip.part'; // md5'evil.zip' = aaae9cba5fdadb1f0c384934cd20d11czip // you...
Unspecified Vulnerability in Total.js Platform
Total.js Platform is a suite of JavaScript Web platforms. The platform includes Total.js framework, Total.js apps, SQL Agent and NoSQL embedded DB. A security vulnerability exists in the index.js file in versions of Total.js Platform prior to 3.2.3. No details of the vulnerability are provided at...
CVE-2019-1000003
MapSVG Lite 3.2.3 is affected by a CSRF in the mapsvg_save AJAX endpoint (/wp-admin/admin-ajax.php?action=mapsvg_save) that can allow an authenticated admin to modify post data (including embedded JavaScript). Exploitation requires the attacker to have an admin account and to entice the admin to ...
WESEEK GROWI Cross-Site Scripting Vulnerability (CNVD-2019-04901)
WESEEK GROWI is a suite of team collaboration software from WESEEK Japan. A cross-site scripting vulnerability exists in WESEEK GROWI 3.2.3 and earlier versions. A remote attacker can exploit this vulnerability to execute arbitrary script in a user's web browser...
WESEEK GROWI cross-site scripting vulnerability (CNVD-2018-26771)
WESEEK GROWI is a suite of team collaboration software from WESEEK Japan. A cross-site scripting vulnerability exists in WESEEK GROWI version 3.2.3 and earlier versions, which can be exploited by a remote attacker to execute arbitrary script in a user's web browser...
phpBB 3.2.3 - Remote Code Execution
// All greets goes to RIPS Tech // Run this JS on Attachment Settings ACP page var pluploadsalt = ''; var formtoken = ''; var creationtime = ''; var filepath = 'phar://./../files/plupload/$saltaaae9cba5fdadb1f0c384934cd20d11czip.part'; // md5'evil.zip' = aaae9cba5fdadb1f0c384934cd20d11czip // you...
Moodle 2.x / 3.x Multiple Vulnerabilities (May 2017) - Linux
Moodle is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...
WordPress BuddyBoss Media plugin <=3.2.3 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability found by ozzy in WordPress BuddyBoss Media plugin versions =3.2.3. Solution 1/22/2018 - no public information or changelog available, we can't confirm that vulnerability is patched...
