adoboloco.com Cross Site Scripting vulnerability

Security Researcher Codingboy Helped patch 14 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting adoboloco.com website and its users. Following coordinated and responsible vulnerabili...

WordPress Unspecified Directory Traversal Vulnerability

Description WordPress is prone to an unspecified directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. Remote attackers may use a specially crafted request with directory-traversal sequences '../' to retrieve sensitive information or execute...

cnasr.it Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1016489 Security Researcher m0nk3ysr Helped patch 2 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting cnasr.it website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO 2914...

WordPress 5.2.4 Cross Origin Resource Sharing

Exploit Title: Wordpress 5.2.4 - Cross-Origin Resource Sharing Date: 2019-10-28 Exploit Author: Milad Khoshdel Software Link: https://wordpress.org/download/ Version: Wordpress 5.2.4 Tested on: Linux Apache/2 PHP/7.2 Vulnerable Page: https://Your-Domain/wp-json POC: The web application fails to...

Fedora 31 : wordpress (2019-f21ad78845)

WordPress 5.2.4 Security Release WordPress versions 5.2.3 and earlier are affected by these bugs, which are fixed in version 5.2.4. Security Updates - Props to Evan Ricafort for finding an issue where stored XSS cross-site scripting could be added via the Customizer. - Props to J.D. Grimes who...

CVE-2019-17675

WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF...

CVE-2019-17672

WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements...

CVE-2019-17674

WordPress before 5.2.4 is vulnerable to stored XSS cross-site scripting via the Customizer...

CVE-2019-17670

WordPress before 5.2.4 has a Server Side Request Forgery SSRF vulnerability because Windows paths are mishandled during certain validation of relative URLs...

CVE-2019-17669

WordPress before 5.2.4 has a Server Side Request Forgery SSRF vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters...

CVE-2019-17672

WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements...

CVE-2019-17675

Summary: CVE-2019-17675 affects WordPress up to version 5.2.3; the flaw stems from type confusion during referer validation in admin pages, enabling CSRF. Impact: CSRF against WordPress admin; no explicit exploitation details are provided in the connected docs beyond this description. Remediation...

PT-2019-15248 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.4 Description: The issue is related to a Server Side Request Forgery SSRF vulnerability. This occurs because Windows paths are mishandled during certain validation of relative URLs. Recommendations: For version...

PT-2019-5218 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.4 Description: The issue is related to a stored XSS attack that allows an attacker to inject JavaScript into STYLE elements. This can potentially impact the integrity of the data. The exploitation of this issue...

Fedora 30 : kernel / kernel-headers / kernel-tools (2019-7aecfe1c4b)

The 5.2.5 stable kernel update contains a number of important fixes across the tree. This should also fix the black screen issue that several i915 users were hitting with 5.2.4. ---- The 5.2.4 kernel rebase contains new features and hardware support, and a number of important fixes across the tre...

CVE-2019-5494

OnCommand Unified Manager 7-Mode prior to version 5.2.4 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors...

IBM Security Identity Governance and Intelligence SQL Injection Vulnerability

IBM Security Identity Governance and Intelligence IGI is a suite of identity management and governance solutions from IBM in the United States. The product includes features such as lifecycle management, access risk assessment and identity management. A SQL injection vulnerability exists in IBM...

IBM Security Identity Governance and Intelligence Information Disclosure Vulnerability

IBM Security Identity Governance and Intelligence IGI is a suite of identity management and governance solutions from IBM in the United States. The product includes features such as lifecycle management, access risk assessment and identity management. An information disclosure vulnerability exist...

CVE-2018-1757

CVE-2018-1757 affects IBM Security Identity Governance and Intelligence (IGI) versions 5.2.3.2 and 5.2.4, where missing authentication in the IGI survey application could allow an attacker to obtain sensitive information. The IBM bulletin notes a vulnerability in the Feedback Survey feature and c...

ILIAS CMS 5.2.3 Cross Site Scripting

---------------------------- Product & Service Introduction: ILIAS is a web base learning management system LMS, VLE. Features: Courses, SCORM 1.2 and 2004, mail, forum, chat, groups, podcast, file sharing, authoring, CMS, test, wiki, personal desktop, LOM, LDAP, role based access. Copy of the...