CVE-2018-0546: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

PT-2018-8905

Name of the Vulnerable Software and Affected Versions WP All Import plugin versions prior to 3.4.7 Description A cross-site scripting issue allows an attacker to inject arbitrary web script or HTML. Recommendations For WP All Import plugin versions prior to 3.4.7, update to version 3.4.7 or later...

WordPress plugin "WP All Import" vulnerable to cross-site scripting

Overview The WordPress plugin "WP All Import" provided by Soflyy contains a reflected cross-site scripting vulnerability CWE-79. Note that this vulnerability is different from JVN33527174. Yuji Tounai of NTT Communications Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with...

WordPress plugin "WP All Import" vulnerable to cross-site scripting

Overview The WordPress plugin "WP All Import" provided by Soflyy contains a cross-site scripting vulnerability CWE-79 in the file upload function. Note that this vulnerability is different from JVN60032768. Mardan Muhidin of Gehirn Inc. reported this vulnerability to IPA. JPCERT/CC coordinated wi...

WordPress WP All Import plugin cross-site scripting vulnerability (CNVD-2018-04771)

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress WP All Import plugin versions prior to 3.4.7, which can be exploited...

WordPress WP All Import Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress WP All Import plugin versions prior to 3.4.6, which can be exploited...

JVN#33527174: WordPress plugin "WP All Import" vulnerable to cross-site scripting

The WordPress plugin "WP All Import" provided by Soflyy contains a cross-site scripting vulnerability CWE-79 in the file upload function. Impact An arbitrary script may be executed on the user's web browser. Solution Update the plugin Update the plugin according to the information provided by the...

all-free-download.com XSS vulnerability

Open Bug Bounty ID: OBB-570491 Description| Value ---|--- Affected Website:| all-free-download.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

beiphone.it XSS vulnerability

Open Bug Bounty ID: OBB-566489 Description| Value ---|--- Affected Website:| beiphone.it Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-6370

SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the 1 PATHINFO or 2 name of a .html file under the all-offers/ URI...

PT-2018-17511

Name of the Vulnerable Software and Affected Versions NeoRecruit version 4.1 Description A SQL Injection issue exists in the NeoRecruit component for Joomla!, which can be exploited via the PATH INFO or the name of a .html file under the all-offers/ URI. Recommendations For NeoRecruit version 4.1...

CVE-2018-6370: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the 1 PATHINFO or 2 name of a .html file under the all-offers/ URI...

all-search.biz XSS vulnerability

Open Bug Bounty ID: OBB-556600 Description| Value ---|--- Affected Website:| all-search.biz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-1000053

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery CSRF vulnerability in Theme Uninstallation that can result in CSRF causing LimeSurvey admins to delete all their themes, rendering the website unusable. This attack appear to be exploitable via Simple HTML markup can be us...

ALPINE-CVE-2018-1053

In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pgupgrade creates file in current working directory containing the output of pgdumpall -g under umask which was in effect when the user invoked pgupgrade, and not under 0077 which...

PT-2018-9240

Name of the Vulnerable Software and Affected Versions: LimeSurvey version 3.0.0-beta.3+17110 Description: The issue concerns a Cross-Site Request Forgery CSRF vulnerability in the Theme Uninstallation feature. This vulnerability can be exploited to trick LimeSurvey administrators into deleting al...

MantisBT Information Disclosure Vulnerability (CNVD-2018-05515 )

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in the viewallbugpage.php file in versions of MantisBT prior to 2018-02-02. A remote...

Debian: Security Advisory (DLA-1120-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2018-4362

Name of the Vulnerable Software and Affected Versions edx Configuration Repo affected versions not specified Description The issue allows remote websites to spoof edX accounts by leveraging the use of the string literal "False" instead of a boolean False for the CORS ORIGIN ALLOW ALL setting...

PT-2018-17614

Name of the Vulnerable Software and Affected Versions MantisBT version 2.10.0-development before 2018-02-02 Description The issue allows remote attackers to discover the full path via an invalid filter parameter. This is related to a filter ensure valid filter call in current user api.php. The...