WESEEK GROWI Cross-Site Scripting Vulnerability

Weseek WESEEK GROWI is a suite of team collaboration software from the Japanese company WESEEK Weseek. A cross-site scripting vulnerability exists in GROWI versions 3.0.2 through 3.8.1. The vulnerability stems from a failure to adequately validate user-supplied data during the processing of a POS...

Bludit Path Traversal Vulnerability

Bludit is an open source, lightweight blog content management system CMS. A path traversal vulnerability exists in Bludit version 3.8.1. An attacker can exploit the vulnerability by deleting arbitrary files / admin / ajax / upload-profile-picture...

WordPress CMP – Coming Soon & Maintenance plugin <= 3.8.1 - Unauthenticated Plugin Deactivation vulnerability

Unauthenticated Plugin Deactivation vulnerability discovered by NinTechNet in WordPress CMP – Coming Soon & Maintenance plugin versions = 3.8.1. Solution Update the WordPress CMP – Coming Soon & Maintenance plugin to the latest available version at least 3.8.2...

Fruitful Theme < 3.8.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The Fruitful WordPress theme, version 3.8 and possibly below, was affected by an unauthenticated Reflected Cross-Site Scripting XSS vulnerability. The vulnerability was patched in version 3.8.1 of the Theme, although the changelog file only mentions: "Bug fix: Fixed issues on comment form" PoC Ad...

Fedora 31 : python38 (2019-26b2e55c90)

This is Python 3.8.1, the first maintenance release of Python 3.8. It contains security fixes as well as bugfixes. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and form...

CVE-2019-11291 RabbitMQ XSS attack via federation and shovel endpoints

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious use...

PT-2019-6093 · Pivotal +3 · Rabbitmq +2

Name of the Vulnerable Software and Affected Versions: Pivotal RabbitMQ versions 3.7.x prior to 3.7.21 Pivotal RabbitMQ versions 3.8.x prior to 3.8.1 RabbitMQ for Pivotal Platform versions 1.16.x prior to 1.16.7 RabbitMQ for Pivotal Platform versions 1.17.x prior to 1.17.4 Description: The issue ...

WordPress wp-ultimate-csv-importer plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. wp-ultimate-csv-importer plugin is used in which a CSV file import/export plugin. A cross-site scripting vulnerability...

PT-2019-7265 · WordPress · Wp Ultimate Csv Importer

Name of the Vulnerable Software and Affected Versions: wp-ultimate-csv-importer plugin version prior to 3.8.1 for WordPress Description: The issue is related to a Cross-Site Scripting XSS problem. XSS is a type of security vulnerability that allows an attacker to inject malicious scripts into a...

CVE-2019-5020

An exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially crafted binary file can cause a negative value to be read to satisfy an assert, resulting in Denial of Service. An attacker can create a malicious binary to trigger this vulnerabili...

CVE-2019-5020

An exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially crafted binary file can cause a negative value to be read to satisfy an assert, resulting in Denial of Service. An attacker can create a malicious binary to trigger this vulnerabili...

CVE-2019-5020

An exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially crafted binary file can cause a negative value to be read to satisfy an assert, resulting in Denial of Service. An attacker can create a malicious binary to trigger this vulnerabili...

YARA Denial of Service Vulnerability (CNVD-2019-26632)

YARA is a set of tools used to help software researchers identify and categorize malware samples. A denial-of-service vulnerability exists in the object lookup feature in YARA version 3.8.1, which can be exploited to cause a denial of service with the help of specially crafted binaries...

WordPress Content Aware Sidebars plugin <= 3.8 - Authenticated Option Update vulnerability (Fremius Library security issue)

Authenticated Option Update vulnerability Fremius Library security issue found in WordPress Content Aware Sidebars plugin versions = 3.8. Solution Update the WordPress Content Aware Sidebars plugin to the latest available version at least 3.8.1...

YARA < 3.8.1 Multiple Vulnerabilities

YARA is prone to multiple vulnerabilities. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribu...

YARA libyara/exec.c File Information Disclosure Vulnerability

YARA is a set of tools used to help software researchers identify and categorize malware samples. A security vulnerability exists in the libyara/exec.c file in YARA version 3.8.1. An attacker could exploit this vulnerability to obtain environment information...

Code injection

In YARA 3.8.1, bytecode in a specially crafted compiled rule is exposed to information about its environment, in libyara/exec.c. This is a consequence of the design of the YARA virtual machine...

Design/Logic Flaw

In YARA 3.8.1, bytecode in a specially crafted compiled rule can read data from any arbitrary address in memory, in libyara/exec.c. Specifically, OPCOUNT can read a DWORD...

UBUNTU-CVE-2018-19976

In YARA 3.8.1, bytecode in a specially crafted compiled rule is exposed to information about its environment, in libyara/exec.c. This is a consequence of the design of the YARA virtual machine...

CVE-2018-19976

CVE-2018-19976 involves YARA 3.8.1 where bytecode in a specially crafted compiled rule can reveal information about the host environment via libyara/exec.c, a consequence of how the YARA VM is designed. Public descriptions in CNVD and OSV confirm an environment-information exposure vulnerability ...