236 matches found
CVE-2020-5502
phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships...
PT-2020-18483 · Phpbb Limited · Phpbb
Name of the Vulnerable Software and Affected Versions: phpBB version 3.2.8 Description: The issue allows for a CSRF attack, enabling the approval of pending group memberships without proper authorization. Recommendations: For phpBB version 3.2.8, update to a newer version that contains a fix for...
PT-2020-18482 · Phpbb Limited · Phpbb
Name of the Vulnerable Software and Affected Versions: phpBB version 3.2.8 Description: The issue allows for a CSRF attack, which can be used to modify a group avatar. Recommendations: For phpBB version 3.2.8, update to a newer version that contains a fix for this issue...
WordPress custom-404-pro plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. custom-404-pro is a 404 page customization plugin used in it. A cross-site scripting vulnerability exists in WordPress custom-404-pro...
PT-2019-14427 · WordPress · Custom 404 Pro
Name of the Vulnerable Software and Affected Versions: custom-404-pro plugin versions prior to 3.2.8 Description: The issue is related to reflected XSS. Recommendations: For versions prior to 3.2.8, update to version 3.2.8 or later to resolve the issue...
CVE-2019-15660
The wp-members plugin before 3.2.8 for WordPress has CSRF...
PT-2019-14328 · WordPress · Wp-Members Plugin
Name of the Vulnerable Software and Affected Versions: wp-members plugin versions prior to 3.2.8 Description: The issue concerns a CSRF problem. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited...
PT-2019-13834 · WordPress · Custom 404 Pro
Name of the Vulnerable Software and Affected Versions: Custom 404 Pro plugin version 3.2.8 Description: The issue concerns a problem with the Custom 404 Pro plugin for WordPress, where there is an XSS issue via the "page" parameter in the wp-admin/admin.php page. Recommendations: For Custom 404 P...
pefprints.pef.uni-lj.si Open Redirect vulnerability
Security Researcher metamorfosec Helped patch 1935 vulnerabilities Received 9 Coordinated Disclosure badges Received 31 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting pefprints.pef.uni-lj.si website and its users...
Redmine cross-site scripting vulnerability (CNVD-2017-31957)
Redmine is a set of open source Web-based project management and defect tracking tools . The tool provides project management , issue tracking and role-based access control and other features . A cross-site scripting vulnerability exists in the app/views/issues/list.html.erb file in Redmine...
DEBIAN-CVE-2017-15571
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/list.html.erb via crafted column data...
CVE-2017-15570
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/list.html.erb via crafted column data...
CVE-2017-15570
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/list.html.erb via crafted column data...
Debian DSA-3996-1 : ffmpeg - security update
Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitrary code if malformed Real, MV, RL2, ASF, Apple HLS, Phantom Cine, MXF, NSV, MOV or RTP H.264 files/streams are processed. %NASLMINLEVEL...
CVE-2017-8382
admidio 3.2.8 has CSRF in admprogram/modules/members/membersfunction.php with an impact of deleting arbitrary user accounts...
CVE-2017-8382
CVE-2017-8382 affects Admidio 3.2.8 via a Cross-Site Request Forgery in the file adm_program/modules/members/members_function.php, allowing an attacker to delete arbitrary user accounts. The vulnerability is CSRF-based; exploitation relies on a crafted request from an authenticated session (requi...
Wordpress enhanced-tooltipglossary plugin cross-site scripting vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . enhanced-tooltipglossary is one of the plug-ins to improve the performance of the view image caching . A...
CVE-2016-1000132
Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8...
Kiwi CatTools TFTP <= 3.2.8 - Remote Path Traversal Vulnerability
No description provided by source. Path traversal security vulnerability in Kiwi CatTools TFTP up to 3.2.8 server can lead to information disclosure and remote code execution Risk: High DISCUSSION Kiwi CatTools TFTP server doesn.t properly verify filename in PUT and GET request which can be used ...