247 matches found
Mellow Fish YetiShare Cross-Site Request Forgery Vulnerability
Mellow Fish YetiShare is a PHP-based file hosting web system script from Mellow Fish UK. A security vulnerability exists in Mellow Fish YetiShare versions 3.5.2 through 4.5.3, which stems from the program not setting the SameSite flag on session cookies. An attacker can exploit this vulnerability...
Unspecified Vulnerability in Mellow Fish YetiShare (CNVD-2020-00226)
Mellow Fish YetiShare is a PHP-based file hosting web system script from Mellow Fish UK. A security vulnerability exists in the class.userpeer.php file in Mellow Fish YetiShare versions 3.5.2 through 4.5.3, which stems from the program using an insecure method to create a password reset hash. An...
Mellow Fish YetiShare Cross-Site Scripting Vulnerability
Mellow Fish YetiShare is a PHP-based file hosting web system script from Mellow Fish UK. A security vulnerability exists in Mellow Fish YetiShare versions 3.5.2 through 4.5.3, which stems from the program not setting the HttpOnly flag on session cookies. An attacker can exploit the vulnerability ...
MFScripts YetiShare Cross-Site Scripting Vulnerability
Mellow Fish YetiShare is a PHP-based file hosting web system script from Mellow Fish UK. A cross-site scripting vulnerability exists in the getallfileserverpaths.ajax.php file in Mellow Fish YetiShare versions 3.5.2 through 4.5.3. The vulnerability stems from a lack of proper validation of...
CVE-2019-19733
getallfileserverpaths.ajax.php aka getallfileserverpaths.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the fileIds parameter on the page, which would allow an attacker to input HTML or execute scripts on the site, aka XSS...
CVE-2019-19733
getallfileserverpaths.ajax.php aka getallfileserverpaths.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the fileIds parameter on the page, which would allow an attacker to input HTML or execute scripts on the site, aka XSS...
AZL-44208 CVE-2016-2125 affecting package samba 4.18.3-2
It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users...
JBoss RichFaces Arbitrary Java Code Execution Vulnerability (CNVD-2018-11847)
Red Hat JBoss RichFaces is the United States Red Hat Red Hat, Inc. of an open source JSF JavaServer Faces component library . The library provides built-in JavaScript and Ajax functionality . A security vulnerability exists in Red Hat JBoss RichFaces versions 4.5.3 through 4.5.17. A remote attack...
Design/Logic Flaw
Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run...
CVE-2016-7831
Sleipnir 4 Black Edition for Mac 4.5.3 and earlier and Sleipnir 4 for Mac 4.5.3 and earlier Mac App Store may allow a remote attacker to spoof the URL display via a specially crafted webpage...
WordPress Connection Information Cross Site Request Forgery Vulnerability
The FTP/SSH form functionality of WordPress was found to be vulnerable to cross site request forgery. WordPress versions 4.5.3 through 4.7.4 are affected. ------------------------------------------------------------------------ Cross-Site Request Forgery in WordPress Connection Information...
WordPress 4.5.3 Audio Playlist Cross Site Scripting
------------------------------------------------------------------------ WordPress audio playlist functionality is affected by Cross-Site Scripting ------------------------------------------------------------------------ Yorick Koster, July 2016...
WordPress 4.5.3 Press This Function CSRF / Denial Of Service Vulnerabilities
Exploit for php platform in category web applications ------------------------------------------------------------------------ Cross-Site Request Forgery in WordPress Press This function allows DoS ------------------------------------------------------------------------ Sipke Mellema, July 2016...
WordPress 4.5.3 Audio Playlist Cross Site Scripting Vulnerability
Exploit for php platform in category web applications ------------------------------------------------------------------------ WordPress audio playlist functionality is affected by Cross-Site Scripting ------------------------------------------------------------------------ Yorick Koster, July 20...
WordPress 4.5.3 Press This Function CSRF / Denial Of Service
------------------------------------------------------------------------ Cross-Site Request Forgery in WordPress Press This function allows DoS ------------------------------------------------------------------------ Sipke Mellema, July 2016...
CVE-2017-2976
Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclosure...
CVE-2017-2976
CVE-2017-2976 affects Adobe Digital Editions versions 4.5.3 and earlier. It is a buffer over-read vulnerability that, when exploited, can lead to information disclosure. The provided documents confirm the vulnerable product/version and the nature of the vulnerability; no exploit status or additio...
CVE-2016-6896
Directory traversal vulnerability in the wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. dot dot in the plugin parameter to wp-admin/admin-ajax.php, as...
Security fix for the ALT Linux 10 package samba version 4.5.3-alt1.S1
Dec. 19, 2016 Evgeny Sinelnikov 4.5.3-alt1.S1 - Update for release with security fixes: - CVE-2016-2123 ndrpulldnspname contains an integer wrap problem - CVE-2016-2125 client code always requests a forwardable ticket - CVE-2016-2126 crash winbindd using a legitimate Kerberos ticket...