php: Invalid memory access in function xmlrpc_decode()

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpcdecode can lead to an invalid memory access heap out of bounds read or read after free. This is related to xmlelemparsebuf in...

CVE-2019-15053

The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element...

Design/Logic Flaw

The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element...

CVE-2019-15053

The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element...

CVE-2015-9312

The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element...

CVE-2015-9313

The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element...

Sql injection

The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element...

CVE-2015-9313

The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element...

CVE-2015-9313

CVE-2015-9313: The WordPress plugin newstatpress (before 1.0.5) is affected by an SQL injection through an IMG element. The root cause is unsafe SQL construction in the plugin’s search path (nsp_search.php), enabling an attacker to potentially disclose data (PoC shows exfiltration of user hashes)...

CVE-2019-15053: Improper Neutralization of Input During Web Page Generation

The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element...

CVE-2015-9312: Improper Neutralization of Input During Web Page Generation

The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element...

CVE-2015-9313: Improper Neutralization of Special Elements used in an SQL Command

The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element...

PT-2019-7271

Name of the Vulnerable Software and Affected Versions newstatpress plugin versions prior to 1.0.5 for WordPress Description The issue is related to a Cross-Site Scripting XSS vulnerability. It is associated with an IMG element. Recommendations For versions prior to 1.0.5, update to version 1.0.5 ...

PT-2019-7272

Name of the Vulnerable Software and Affected Versions newstatpress plugin versions prior to 1.0.5 for WordPress Description The issue is related to SQL injection, specifically concerning an IMG element. Recommendations For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the...

NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0158)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has thunderbird packages installed that are affected by multiple vulnerabilities: - pngimagefree in png.c in libpng 1.6.36 has a use- after-free because pngimagefreefunction is called under pngsafeexecute. CVE-2019-7317 - If a...

Information Disclosure

kde-workspace is vulnerable to information disclosure. It does not sanitize the notifications, allowing to leak client IP address via IMG element...

kde-workspace: Missing sanitization of notifications allows to leak client IP address via IMG element

An issue was discovered in KDE Plasma Workspace before 5.12.0. dataengines/notifications/notificationsengine.cpp allows remote attackers to discover client IP addresses via a URL in a notification, as demonstrated by the src attribute of an IMG element...

Cross site scripting

pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element...

CVE-2019-14653: Improper Neutralization of Input During Web Page Generation

pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element...

icedtea-web: path traversal while processing <jar/> elements of JNLP files results in arbitrary file overwrite

It was found that icedtea-web did not properly sanitize paths from elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user...