CVE-2018-20677

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property...

PT-2019-5359 · Twitter +4 · Bootstrap +4

Name of the Vulnerable Software and Affected Versions: Bootstrap versions prior to 3.4.0 Description: The issue is related to the affix plugin in Bootstrap, which does not properly protect the structure of a web page, allowing for potential exploitation. This could enable a remote attacker to...

Modernizr 3.x < 3.4.0 Marked Multiple Vulnerabilities

According to its self-reported version number, Modernizr is 3.x prior to 3.4.0. Therefore, it may be affected by multiple vulnerabilities due to Marked component. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. N...

UPDATED VERSION: RouterSploit 3.4.0

PenTestIT RSS Feed RouterSploit 3.4.0, the long awaited router exploitation framework update is out guys! This release includes some really cool features and updates such as using pycryptodome from pycryptoand newer exploitation modules! Read on for the improvements. What is RouterSploit? The...

com.graphaware.neo4j:server (>=3.4.0.52 <=3.4.12.52), com.graphaware.neo4j:tests (>=3.4.0.52 <=3.4.12.52) +17 more potentially affected by CVE-2018-18389 via org.neo4j:neo4j-enterprise (>=3.4.0 <=3.4.8)

org.neo4j:neo4j-enterprise MAVEN version =3.4.0, =3.4.0.52, =3.4.0.52, =3.0.0, =2.1.5, =2.1.5, =2.1.5, =2.1.5, =3.4.0, =3.4.0, =0.1.9, =0.2.7 and more Source cves: CVE-2018-18389 Source advisory: OSV:GHSA-H5F5-RJ4R-42F6...

Code injection

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming...

Rubedo Directory Traversal Vulnerability

Rubedo is a content management system. theme is one of the theme components. A path traversal vulnerability exists in the theme component in Rubedo 3.4.0 and earlier. An attacker can use this vulnerability to read and execute arbitrary files outside of the root directory of the service...

GHSA-7MVR-5X2G-WFC8 Bootstrap Cross-site Scripting vulnerability

In Bootstrap starting in version 2.3.0 and prior to versions 3.4.0 and 4.1.2, XSS is possible in the data-container property of tooltip. This is similar to CVE-2018-14041...

Rubedo CMS 3.4.0 - Directory Traversal

Exploit Title: Rubedo CMS 3.4.0 - Directory Traversal Google Dork: intext:rubedo.current.page.description Date: 2018-09-11 Exploit Author: Marouene Boubakri Vendor Homepage: https://www.rubedo-project.org Version: through 3.4.0 Tested on: Linux CVE : CVE-2018-16836 PoC: Read /etc/passwd file from...

CVE-2018-16836

Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI...

CVE-2018-1127

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user...

CVE-2018-16761

Eventum before 3.4.0 has an open redirect vulnerability...

CVE-2018-16761

Eventum before 3.4.0 has an open redirect vulnerability...

katello-debug Arbitrary File Overwrite Vulnerability

Katello is a system management engine that provides workflows for configuration management, subscription management and content management. katello-debug is one of the debuggers. An arbitrary file overwrite vulnerability exists in versions prior to katello-debug 3.4.0, which stems from the use of...

booking calendar for joomla!

Booking Calendar for Joomla! update to 3.4.0 various security patches. Note END OF LIFE https://www.joomlabookingcalendar.com/last-update/ Last known version number 3.4.0...

Moodle 3.x Authentication Bypass Vulnerability (Mar 2018) - Windows

Suspended users with OAuth 2 authentication method can still log in to the site. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Octopus Deploy 'Variable Set Name' Parameter Cross-Site Scripting Vulnerability

Octopus Deploy is an automation tool from Octopus Deploy Australia for development and deployment of . A cross-site scripting vulnerability exists in the All Variables tag in Octopus Deploy versions 3.4.0-3.13.6. A remote attacker can exploit this vulnerability to inject arbitrary web script or...

Kabona AB WebDatorCentral Password Plaintext Storage Vulnerability

Kabona AB WebDatorCentral WDC is a Web-based SCADA system from Kabona AB, Sweden. A password plaintext storage vulnerability exists in Kabona AB WDC versions prior to 3.4.0 that originates from the program storing password certificates in plaintext. An attacker could exploit the vulnerability to...

Default credentials

A Plaintext Storage of a Password issue was discovered in Kabona AB WebDatorCentral WDC versions prior to Version 3.4.0. WDC stores password credentials in plaintext...

GoAhead Denial of Service Vulnerability

GoAhead is the United States Embedthis company a small embedded Web server , it supports embedded in a variety of devices and applications . A denial of service vulnerability exists in the 'websDecodeUrl' function of the http.c file in GoAhead versions 3.4.0 through 3.6.5. An attacker can exploit...