php: Heap buffer overflow in function exif_iif_add_value()

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exifiifaddvalue function. This may lead to information disclosure or crash...

Backup proxy that uses Virtual Appliance (HotAdd) mode and is installed on Microsoft Windows 2019 shows "Restart Required" message

Challenge When you log in to the Veeam backup proxy server interactively following the execution of a job using the hot add transport mode, you may get a notification from the OS prompting to restart the server. The notification can be one of the following: Your PC needs to be restarted to finish...

WordPress wp-google-map-plugin plugin cross-site request forgery vulnerability (CNVD-2019-28881)

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wp-google-map-plugin plugin is a Google Maps plugin used in it. A cross-site request forgery vulnerability exists in th...

CVE-2016-10883

The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users...

Cross site request forgery (csrf)

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature...

CVE-2015-9307

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature...

PT-2019-7264 · WordPress · Wp-Google-Map-Plugin

Name of the Vulnerable Software and Affected Versions: wp-google-map-plugin versions prior to 2.3.7 Description: The issue is related to Cross-Site Scripting XSS and involves the add query arg and remove query arg functions. Recommendations: For versions prior to 2.3.7, update to version 2.3.7 or...

Schben Adive Privilege Control Vulnerability

Schben Adive is a PHP-based web development framework . A security vulnerability exists in the Internal/Views/addUsers.php file in Schben Adive version 2.0.7. A remote attacker can exploit this vulnerability to create administrator privileges with admin/user/add...

CVE-2019-14347

Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users editor or developer to create an administrator account via admin/user/add, as demonstrated by a Python PoC script...

exiv2: SIGABRT by triggering an incorrect Safe::add call

An issue was discovered in Exiv2 0.26. readMetadata in jp2image.cpp allows remote attackers to cause a denial of service SIGABRT by triggering an incorrect Safe::add call...

PT-2019-13626 · Unknown · Schben Adive

Name of the Vulnerable Software and Affected Versions: Schben Adive version 2.0.7 Description: The issue allows remote unprivileged users, such as editors or developers, to create an administrator account. This can be achieved via the admin/user/add endpoint, as demonstrated by a Python...

CVE-2019-14550

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which would fire when a user clicks on the Edit Dashboard button, thus...

CVE-2017-18456

cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface SEC-217...

Cross site scripting

Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to admin/users...

CVE-2013-7474

Windu CMS 2.2 is affected by a Cross-Site Scripting (XSS) vulnerability. The flaw allows injection via the name parameter in admin/content/edit or admin/content/add, or via the username parameter in admin/users. The NVD records show a CVSS base score of 4.3 (CS: Partial integrity impact, Network ...

CVE-2019-14297

Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...

CVE-2019-14298

Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Descriptionconfig field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx...

CVE-2019-14297

Veeam ONE Reporter 9.5.0.3201 is affected by a cross-site scripting vulnerability. The issue arises in the Add/Edit Widget functionality where a crafted value in the Caption field can impact setDashboardWidget in CommonDataHandlerReadOnly.ashx, indicating insufficient input validation/encoding in...

CVE-2019-14297

Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...

CVE-2019-11723

A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different "containers" for people who use the Firefox Multi-Account Containers Web Extension. This...