CVE-2019-19458

SALTO ProAccess SPACE 5.4.3.0 allows Directory Traversal in the Data Export feature...

Directory traversal

SALTO ProAccess SPACE 5.4.3.0 allows Directory Traversal in the Data Export feature...

CVE-2019-19458

SALTO ProAccess SPACE 5.4.3.0 has a Directory Traversal vulnerability in the Data Export feature (CVE-2019-19458). Exploitation can enable an attacker to write arbitrary content to arbitrary files under the web root; in practice, this can lead to executing arbitrary commands on the server per rel...

CVE-2019-19458: Improper Limitation of a Pathname to a Restricted Directory

SALTO ProAccess SPACE 5.4.3.0 allows Directory Traversal in the Data Export feature...

PT-2019-15843

Name of the Vulnerable Software and Affected Versions SALTO ProAccess SPACE version 5.4.3.0 Description The issue allows Directory Traversal in the Data Export feature. Recommendations For version 5.4.3.0, at the moment, there is no information about a newer version that contains a fix for this...

[SECURITY] Fedora 30 Update: phpMyAdmin-4.9.2-1.fc30

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...

[SECURITY] Fedora 31 Update: phpMyAdmin-4.9.2-1.fc31

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...

kocaeliolay.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1026681 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting kocaeliolay.com website a...

sagepeople.com Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8616 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting sagepeople.com website and its users. Following coordinate...

kz.rsdelivers.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1022487 Security Researcher Hchabik Helped patch 2378 vulnerabilities Received 5 Coordinated Disclosure badges Received 2 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting kz.rsdelivers.com website a...

airesources.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1016963 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting airesources.org website a...

dendekkerassurantien.nl Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1006456 Security Researcher devl00p Helped patch 2582 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting dendekkerassurantien.nl...

engineering.purdue.edu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1000966 Security Researcher Gh05tPT Helped patch 6892 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting engineering.purdue.edu...

CVE-2019-16698: Missing Authorization

The directmail aka Direct Mail extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user with restricted permissions to the feusers table to view and export data of frontend users who are subscribed to a newsletter...

catalogue.patchworkandco.fr Cross Site Scripting vulnerability

Security Researcher KhanJanny Helped patch 2643 vulnerabilities Received 9 Coordinated Disclosure badges Received 38 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting catalogue.patchworkandco.fr website and its users...

vallada.listado-empresas.es Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-979781 Security Researcher Gh05tPT Helped patch 6901 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting vallada.listado-empresas....

brunodevriendt.be Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-978126 Security Researcher devl00p Helped patch 2974 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting brunodevriendt.be website...

za.thefinancejob.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-975675 Security Researcher 0xrocky Helped patch 1796 vulnerabilities Received 7 Coordinated Disclosure badges Received 5 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting za.thefinancejob.com website...

PT-2019-20538

This module allows you to attach tabular data to an entity. There is insufficient access checking for users with the ability to "Export Tablefield Data as CSV". They can export data from unpublished nodes or otherwise inaccessible entities. This vulnerability is mitigated by the fact that an...

Social Metrics Tracker <= 1.6.8 - Unauthorised Data Export

The lack of proper authorisation when exporting data from the plugin could allow unauthenticated users to get information about the posts and page of the blog, including their author's username and email. The plugin is still affected and has been closed. curl...