38615 matches found
CVE-2016-0796
Summary (CVE-2016-0796): The WordPress plugin mb.miniAudioPlayer—HTML5 audio player for your mp3 files (versions 1.7.6 and earlier)—is vulnerable due to improper validation of user-supplied input, enabling open proxy and security bypass scenarios. Impact includes attacker-initiated actions from a...
CVE-2016-4991
Input passed to the Pdf function is shell escaped and passed to childprocess.exec during PDF rendering. However, the shell escape does not properly encode all special characters, namely, semicolon and curly braces. This can be abused to achieve command execution. This problem affects nodepdf 1.3....
CVE-2016-4991
CVE-2016-4991 affects the NodePDF tool, specifically version 1.3.0. The vulnerability arises because input passed to the Pdf() function is shell-escaped and handed to child_process.exec() during PDF rendering, and the escape does not encode all special characters (notably semicolon and curly brac...
CVE-2016-4427
In zulip before 1.3.12, deactivated users could access messages if SSO was enabled...
CVE-2016-4427
CVE-2016-4427 affects Zulip before 1.3.12, where deactivated users could access messages if Single Sign-On (SSO) is enabled. The issue is documented across multiple sources (Red Hat, OSV, NVD/CVE record) and is limited to versions prior to 1.3.12; the security impact is that non-active accounts m...
CVE-2016-4426
CVE-2016-4426 affects Zulip prior to 1.3.12, where bot API keys were accessible to other users in the same realm. Remediation: upgrade to Zulip 1.3.12 or later. NVD lists CVSS v3.1 base score 4.3 (Medium). No exploitation details are provided in the available documents.
CVE-2016-2138
In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in xssclean in class/KippoInput.class.php...
CVE-2016-2139
In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in $filelink in class/KippoInput.class.php...
CVE-2016-2139
CVE-2016-2139 affects kippo-graph prior to version 1.5.1. The vulnerability is a cross-site scripting flaw in the $file_link handling inside KippoInput.class.php. Impact is described as a cross-site scripting vulnerability; no exploitation details are provided beyond the existence of XSS in that ...
CVE-2016-2138
The CVE-2016-2138 entry concerns kippo-graph prior to version 1.5.1. The vulnerability is a cross-site scripting issue in xss_clean() within class/KippoInput.class.php, as described across multiple connected records (Red Hat, OSV, NVD, and related security trackers). Impact details in the sources...
CVE-2016-15004
A vulnerability was found in InfiniteWP Client Plugin 1.5.1.3/1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to injection. The attack can be launched remotely. Upgrading to version 1.6.1.1 is able to address this issue. ...
CVE-2016-15004
CVE-2016-15004 affects InfiniteWP Client Plugin for WordPress (versions around 1.5.1.3/1.6.0). The vulnerability type is an injection caused by an unknown faulty functionality, permitting a remote attack. Supported by connected documents, the issue is addressed by upgrading to version 1.6.1.1. Ex...
USN-5455-1: xmltok library vulnerabilities
Tim Boddy, Gustavo Grieco and others discovered that Expat, that is integrated in xmltok library, incorrectly handled certain files. An attacker could possibly use these issues to cause a denial of service, or possibly execute arbitrary code. These issues were only addressed in Ubuntu 16.04 ESM...
Fixed CVE-2016-10012 in openssh
CVE-2016-10012: re-remove pre-authentication compression and potentially unsecure shared memory manager used by zlib - Move not yet valid timestamps for certs to 2030-2040 range, make sure all tests are passed and add %check unset DISPLAY section...
CVE-2016-15003 FileZilla Client Installer uninstall.exe unquoted search path
A vulnerability has been found in FileZilla Client 3.17.0.0 and classified as problematic. This vulnerability affects unknown code of the file C:\Program Files\FileZilla FTP Client\uninstall.exe of the component Installer. The manipulation leads to unquoted search path. The attack can be initiate...
CVE-2016-15003
FileZilla Client 3.17.0.0 is affected by a local unquoted search path vulnerability in the Installer uninstall.exe. The underlying issue is an unquoted path in the uninstall component, which can be exploited to cause elevated access. The available description notes that the attack can be initiate...
CVE-2016-15003 FileZilla Client Installer uninstall.exe unquoted search path
A vulnerability has been found in FileZilla Client 3.17.0.0 and classified as problematic. This vulnerability affects unknown code of the file C:\Program Files\FileZilla FTP Client\uninstall.exe of the component Installer. The manipulation leads to unquoted search path. The attack can be initiate...