WordPress WP All Import plugin cross-site scripting vulnerability (CNVD-2018-04771)

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress WP All Import plugin versions prior to 3.4.7, which can be exploited...

WordPress WP All Import Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress WP All Import plugin versions prior to 3.4.6, which can be exploited...

JVN#33527174: WordPress plugin "WP All Import" vulnerable to cross-site scripting

The WordPress plugin "WP All Import" provided by Soflyy contains a cross-site scripting vulnerability CWE-79 in the file upload function. Impact An arbitrary script may be executed on the user's web browser. Solution Update the plugin Update the plugin according to the information provided by the...

all-free-download.com XSS vulnerability

Open Bug Bounty ID: OBB-570491 Description| Value ---|--- Affected Website:| all-free-download.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

beiphone.it XSS vulnerability

Open Bug Bounty ID: OBB-566489 Description| Value ---|--- Affected Website:| beiphone.it Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-6370

SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the 1 PATHINFO or 2 name of a .html file under the all-offers/ URI...

PT-2018-17511

Name of the Vulnerable Software and Affected Versions NeoRecruit version 4.1 Description A SQL Injection issue exists in the NeoRecruit component for Joomla!, which can be exploited via the PATH INFO or the name of a .html file under the all-offers/ URI. Recommendations For NeoRecruit version 4.1...

CVE-2018-6370: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the 1 PATHINFO or 2 name of a .html file under the all-offers/ URI...

all-search.biz XSS vulnerability

Open Bug Bounty ID: OBB-556600 Description| Value ---|--- Affected Website:| all-search.biz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-1000053

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery CSRF vulnerability in Theme Uninstallation that can result in CSRF causing LimeSurvey admins to delete all their themes, rendering the website unusable. This attack appear to be exploitable via Simple HTML markup can be us...

ALPINE-CVE-2018-1053

In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pgupgrade creates file in current working directory containing the output of pgdumpall -g under umask which was in effect when the user invoked pgupgrade, and not under 0077 which...

PT-2018-9240

Name of the Vulnerable Software and Affected Versions: LimeSurvey version 3.0.0-beta.3+17110 Description: The issue concerns a Cross-Site Request Forgery CSRF vulnerability in the Theme Uninstallation feature. This vulnerability can be exploited to trick LimeSurvey administrators into deleting al...

MantisBT Information Disclosure Vulnerability (CNVD-2018-05515 )

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in the viewallbugpage.php file in versions of MantisBT prior to 2018-02-02. A remote...

Debian: Security Advisory (DLA-1120-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2018-4362

Name of the Vulnerable Software and Affected Versions edx Configuration Repo affected versions not specified Description The issue allows remote websites to spoof edX accounts by leveraging the use of the string literal "False" instead of a boolean False for the CORS ORIGIN ALLOW ALL setting...

PT-2018-17614

Name of the Vulnerable Software and Affected Versions MantisBT version 2.10.0-development before 2018-02-02 Description The issue allows remote attackers to discover the full path via an invalid filter parameter. This is related to a filter ensure valid filter call in current user api.php. The...

PT-2018-7107

Name of the Vulnerable Software and Affected Versions: Puppet Enterprise versions prior to 2016.4.5 Puppet Enterprise versions prior to 2017.2.1 Description: The issue concerns a configuration in MCollective that allows the package plugin to install or remove arbitrary packages on all managed...

WordPress Email Subscribers & Newsletters Plugin Information Disclosure Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters plugin is used in one of the push message plugin. An information disclosure vulnerability exists in...

CVE-2018-6015

An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=viewallsubscribers in the body, allows downloading of a CSV data file with all subscriber data...

abbot:costello (1.4.0), aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.6) +4959 more potentially affected by CVE-2016-6814 via org.codehaus.groovy:groovy-all (>=1.7.0, <=2.4.7)

org.codehaus.groovy:groovy-all MAVEN version =1.7.0, =0.0.1, =1.0.0, =0.0.20, =0.2.dev, =0.2.dev, =2.1.10, =2.2.11, =2.2.11, =2.0.0, =2.0.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =3.5.0-rc.1 and more Source cves: CVE-2016-6814 Source advisory: MEND:CVE-2016-6814...