PYSEC-2020-248

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...

PYSEC-2020-246

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...

CVE-2020-28736

CVE-2020-28736 affects Plone prior to 5.2.3. A XXE vulnerability exists in a feature protected by the unapplied permission plone.schemaeditor.ManageSchemata, making it accessible only to the Manager role. This leads to XML External Entity attacks that could impact confidentiality, integrity, and ...

CVE-2020-28735

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...

PT-2020-17039

Name of the Vulnerable Software and Affected Versions Plone versions prior to 5.2.3 Description The issue allows XXE attacks via a feature protected by an unapplied permission of plone.schemaeditor.ManageSchemata, which is only available to the Manager role. Recommendations For versions prior to...

PHP < 5.2.3 Multiple Vulnerabilities

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; ifdescription...

sunwestgenetics.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1167115 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

CVE-2020-12699

The directmail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl...

Open redirect

The directmail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl...

PT-2020-13211

Name of the Vulnerable Software and Affected Versions: direct mail extension for TYPO3 versions through 5.2.3 Description: The issue allows for Denial of Service via log entries. Recommendations: For versions through 5.2.3, update to a version later than 5.2.3 to resolve the issue...

TYPO3 Direct Mail Component Information Disclosure Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland. direct Mail is an email marketing extension plugin used in it. An information disclosure vulnerability exists in the Direct Mail component of TYPO3 5.2.3 and prior versions. The...

Pivotal Software Spring Framework Cross-Site Scripting Vulnerability

Pivotal Software Spring Framework is the U.S. Pivotal Software's set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications . A cross-site scripting vulnerability exists in Pivotal Software Spring Framework versions 5.2.x prior to 5.2.3,...

WordPress Multiple Vulnerabilities (Oct 2019) - Linux

WordPress is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescripti...

naswithnotepads.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-994260 Security Researcher drok3r Helped patch 244 vulnerabilities Received 4 Coordinated Disclosure badges Received 1 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting naswithnotepads.com website an...

CVE-2019-16222

WordPress before 5.2.3 has an issue with URL sanitization in wpksesbadprotocolonce in wp-includes/kses.php that can lead to cross-site scripting XSS attacks...

CVE-2019-16221

WordPress before 5.2.3 allows reflected XSS in the dashboard...

CVE-2019-16217

WordPress before 5.2.3 allows XSS in media uploads because wpajaxuploadattachment is mishandled...

CVE-2019-16217

WordPress before 5.2.3 allows XSS in media uploads because wpajaxuploadattachment is mishandled...

CVE-2019-16219

WordPress before 5.2.3 allows XSS in shortcode previews...

CVE-2019-16222

WordPress before 5.2.3 has an issue with URL sanitization in wpksesbadprotocolonce in wp-includes/kses.php that can lead to cross-site scripting XSS attacks...