CVE-2018-1000529

CVE-2018-1000529 concerns the Grails Fields plugin (version 2.2.7) and its use of display tags, where an XSS vulnerability could be triggered. The connected advisories confirm the issue and state that it has been fixed in version 2.2.8 . The available documents describe the affected component (or...

CVE-2018-1000529

Grails Fields plugin version 2.2.7 contains a Cross Site Scripting XSS vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fixed in 2.2.8...

WordPress Plugin Advanced Order Export For WooCommerce < 1.5.4 - CSV Injection

Exploit Title: Wordpress Plugin Advanced Order Export For WooCommerce 1.5.4 - CSV Injection Google Dork: N/A Date: 2018-06-24 Exploit Author: Bhushan B. Patil Software Link: https://wordpress.org/plugins/woo-order-export-lite/ Affected Version: 1.5.4 and before Category: Plugins and Extensions...

[20181003] - Core - Access level Violation in com_tags

Inadequate checks on the tags search fields can lead to an access level violation...

SUSE-SU-2018:1757-1 Security update for salt

This update for salt provides version 2018.3 and brings many fixes and improvements: - Fix for sorting of multi-version packages bsc1097174 and bsc1097413 - Align SUSE salt-master.service 'LimitNOFILES' limit with upstream Salt - Add 'other' attribute to GECOS fields to avoid inconsistencies with...

Security Bulletin: Content Collector for Email is affected by vulnerability due to information disclosure in Apache MyFaces

Summary Content Collector for Email has addressed following vulnerability: Apache MyFaces could allow a remote attacker using specially crafted parameters to inject EL expressions into input fields mapped as view parameters and obtain sensitive information. Vulnerability Details CVEID:...

CVE-2017-7848

RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird 52.5.2...

Google Chrome Views Unauthorized Access Vulnerability

Google Chrome is a web browser developed by Google, Inc.Views is one of the view components. A security vulnerability exists in Views in versions of Google Chrome prior to 67.0.3396.62, which stems from a failure to use operating system protection for password fields. An attacker could exploit th...

[SECURITY] [DSA 4191-2] redmine regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-4191-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 03, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4191-2] redmine regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-4191-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 03, 2018 https://www.debian.org/security/faq -...

CVE-2012-10025

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wpadvancedcustomfieldsexec.rb 2025-10-23 21:12:56+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7...

Cross-site Scripting (XSS)

Overview org.grails.plugins:fields is a customizable form-field rendering based on overrideable GSP template. Affected versions of this package are vulnerable to Cross-site Scripting XSS. Domain objects being displayed by tags of the plugin containing HTML or JavaScript code are not being encoded...

CVE-2018-11321

An issue was discovered in comfields in Joomla! Core before 3.8.8. Inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option...

CVE-2018-11321

An issue was discovered in comfields in Joomla! Core before 3.8.8. Inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option...

Malicious Package

Overview Version 0.0.3 of dynamo-schema contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.0.3 of this module is found install...

Malicious Package

Overview Version 0.0.4 of dossier contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.0.4 of this module is found installed you...

Malicious Package

Overview Version 1.7.5 of coffee-project contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.7.5 of this module is found...

Malicious Package

Overview Version 4.1.48 of another-date-range-picker contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 4.1.48 of this module is...

CVE-2018-11105

There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" aka wplcname and "email" aka wplcemail input fields to wp-json/wplivechatsupport/v1/startchat whenever a malicious attacker would initiate a new chat with an administrator. NOTE: thi...

CVE-2018-11105

There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" aka wplcname and "email" aka wplcemail input fields to wp-json/wplivechatsupport/v1/startchat whenever a malicious attacker would initiate a new chat with an administrator. NOTE: thi...