66 matches found
CVE-2022-4939 WCFM Membership <= 2.10.0 - Unauthenticated Privilege Escalation
THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on the wpajaxnoprivwcfmajaxcontroller AJAX action that controls membership settings. This makes it possible for unauthenticated attackers to...
YUI Cross-site Scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML...
CVE-2020-4939
IBM Jazz for Service Management (JazzSM) is vulnerable to Stored Cross-Site Scripting (CVE-2020-4939) affecting WebGUI 8.1.0 GA/FP and JazzSM 1.1.3. The vulnerability allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. A fix...
Ubuntu 18.04 LTS / 20.04 LTS : WebKitGTK vulnerabilities (USN-4939-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4939-1 advisory. A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a maliciou...
Security Bulletin: IBM Jazz for Service Management is vulnerable to Stored Cross-Site Scripting (CVE-2020-4939)
Summary IBM Jazz for Service Management is vulnerable to Stored Cross-Site Scripting CVE-2020-4939 Vulnerability Details CVEID: CVE-2020-4939 Description: IBM Jazz for Service Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t...
CVE-2018-4939
creationtimestamp| type| source ---|---|--- 2020-10-20 15:57:21+00:00| seen| MISP/42d04e94-bf5b-427d-acc8-f5d740675941 2020-10-20 15:58:03+00:00| seen| MISP/d925a2ee-e7cf-46f6-bec1-ad8e19122730 2020-10-21 08:33:50+00:00| seen| MISP/5f850411-c103-491f-abff-9421425403cf 2020-10-28 02:58:38+00:00|...
Adobe ColdFusion DataServicesCFProxy Insecure Deserialization (CVE-2018-4939)
An insecure deserialization vulnerability exists in the Flex integration service of Adobe ColdFusion. The vulnerability is due to the lack of input validation. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
ColdFusion RCE(CVE-2018-4939)
In October 2017 I published an overview and video proof-of-concept of a Java RMI/deserialization vulnerability affecting the Flex Integration service of Adobe ColdFusion. I held off on publishing all of the details and exploit code at the time because I spotted an additional exploit payload that...
CVE-2018-4939
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution...
CVE-2018-4939
Adobe ColdFusion is affected by CVE-2018-4939 due to a Deserialization of Untrusted Data vulnerability in Update 5 and earlier (and ColdFusion 11 Update 13 and earlier). The issue arises from insecure deserialization in the DataServicesCFProxy/integration flow, enabling arbitrary code execution u...
Adobe ColdFusion 11.x < 11u14 / 2016.x < 2016u6 Multiple Vulnerabilities (APSB18-14)
The version of Adobe ColdFusion running on the remote Windows host is 11.x prior to update 14 or 2016.x prior to update 6. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid109017; scriptversion"1.9";...
CVE-2017-4939
CVE-2017-4939 is a DLL hijacking vulnerability in the VMware Workstation installer for 12.x, prior to 12.5.8. The issue arises from improper DLL loading, enabling an attacker to load a DLL of their choosing and potentially execute arbitrary code. Connected advisories also detail related issues (e...
CVE-2016-4939
CVE-2016-4939 entry is rejected/not used per the description and does not represent an active vulnerability.
CVE-2015-4939
Cross-site scripting XSS vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management 10.x before 10.0.1.4iFix3, 10.0.2.x before 10.0.2.7iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0iFix1 allows remote attackers to inject arbitrary web script or HTML...
SolarWinds Orion IP Address Manager (IPAM) 'search.aspx' Cross Site Scripting Vulnerability
CVE-2012-4939SolarWinds Orion IP Address Manager IPAM is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affect...
CVE-2014-4939
SQL injection vulnerability in the ENL Newsletter enl-newsletter plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the enl-add-new page to wp-admin/admin.php...
CVE-2014-4939
The CVE-2014-4939 entry concerns the ENL Newsletter (enl-newsletter) WordPress plugin, version 1.0.1. Affected component: wp-admin/admin.php enl-add-new page, where the id parameter allows SQL injection. The root cause is an input parameter in the admin interface that can be manipulated to execut...
openSUSE Security Update : ldapsmb (openSUSE-SU-2011:0998-1)
A Cross-Site Request Forgery CSRF and a Cross Site Scripting vulnerability have been fixed in samba's SWAT. CVE-2011-2522 and CVE-2011-2694 have been assigned. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...