[SECURITY] Fedora 32 Update: php-horde-kronolith-4.2.29-1.fc32

Kronolith is the Horde calendar application. It provides web-based calendars backed by a SQL database or a Kolab server. Supported features include Ajax and mobile interfaces, shared calendars, remote calendars, invitation management iCalendar/iTip, free/busy management, resource management,...

Docsify.js 4.11.4 Cross Site Scripting

Exploit Title: Docsify.js 4.11.4 - Reflective Cross-Site Scripting Date: 2020-06-22 Exploit Author: Amin Sharifi Vendor Homepage: https://docsify.js.org Software Link: https://github.com/docsifyjs/docsify Version: 4.11.4 Tested on: Windows 10 CVE : CVE-2020-7680 docsify.js uses fragment identifie...

CVE-2020-15700

An issue was discovered in Joomla! through 3.9.19. A missing token check in the ajaxinstall endpoint of cominstaller causes a CSRF vulnerability...

CVE-2020-15299

A reflected Cross-Site Scripting XSS Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an installonlinepreset AJAX request containing base64-encoded JavaScript in the kc-online-preset-data POST parameter that is executed...

Cross site scripting

A reflected Cross-Site Scripting XSS Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an installonlinepreset AJAX request containing base64-encoded JavaScript in the kc-online-preset-data POST parameter that is executed...

CVE-2020-15299

A reflected Cross-Site Scripting XSS Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an installonlinepreset AJAX request containing base64-encoded JavaScript in the kc-online-preset-data POST parameter that is executed...

KingComposer < 2.9.5 - Unauthenticated Reflected Cross-Site Scripting

A reflected Cross-Site Scripting XSS Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an installonlinepreset AJAX request containing base64-encoded JavaScript in the kc-online-preset-data POST parameter that is executed...

Debian: Security Advisory (DSA-4720-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-8520

SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

CVE-2020-8521

SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

Sql injection

SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

Sql injection

SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

Sql injection

SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

CVE-2020-8521

CVE-2020-8521 describes an SQL injection in Phpzag’s DataTables Records.php (used for live add/edit/delete of records via Ajax). The vulnerability stems from unsafe handling of the start and length parameters in Records.php, enabling an attacker to manipulate SQL queries. Multiple sources (NVD, R...

CVE-2020-8521

SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

CVE-2020-8519

CVE-2020-8519 is a SQL injection in SpryMedia DataTables (Records.php) used by Phpzag’s live data tables (Ajax PHP/MySQL). The vulnerability arises from an unsafe search parameter in Records.php, enabling manipulation of table records. Documented scores indicate high to critical severity (CVSS v3...

CVE-2020-8520

CVE-2020-8520 describes an SQL injection in the Records.php file used by Phpzag Live DataTables (and related SpryMedia DataTables implementations) where the vulnerable code handles the order and column parameters. The underlying flaw permits crafting statements via these parameters, enabling mani...

CVE-2020-8519

SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

Security & Malware scan by CleanTalk < 2.51 - Security Nonce Leak leading to Unauthorised AJAX call

Security nonce leak, allowing any authenticated users such as subscribers to make unauthorised AJAX call which could lead to arbitrary file deletion/download and function call. Note WPScanTeam: We do not consider the issue fully remediated, as the AJAX calls rely on CSRF check for authorisation,...

Telerik UI for ASP.NET AJAX RadAsyncUpload .NET Deserialization Vulnerability

According to its self-reported version number, the version of Telerik UI for ASP.NET AJAX prior to 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or...