CVE-2016-10914

The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file...

CVE-2016-10914: Cross-Site Request Forgery (CSRF)

The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file...

PT-2019-7710

Name of the Vulnerable Software and Affected Versions WordPress add-from-server plugin versions prior to 3.3.2 Description The issue concerns a CSRF problem that allows the import of a large file. Recommendations For versions prior to 3.3.2, update to version 3.3.2 or later to resolve the issue...

bangkok.immigration.go.th Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-928873 Security Researcher KhanJanny Helped patch 3055 vulnerabilities Received 9 Coordinated Disclosure badges Received 38 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting bangkok.immigration.go.th...

CVE-2019-14683

The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acuideleteattachment CSRF...

CVE-2019-14683: Cross-Site Request Forgery (CSRF)

The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acuideleteattachment CSRF...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data increate-from-bill name field, allowing an attacker to inject malicious script...

CVE-2019-14670

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation...

CVE-2019-14670

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation...

CVE-2019-14670

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation...

CVE-2019-11198

Multiple cross-site scripting XSS vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 300583 - List Manager Dashboard module, 2 307638 - Campaign Creator module, 3 316994 - Attributes field, 4 I316995 - Icon Selection module, 5...

CVE-2019-11198

Multiple cross-site scripting XSS vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 300583 - List Manager Dashboard module, 2 307638 - Campaign Creator module, 3 316994 - Attributes field, 4 I316995 - Icon Selection module, 5...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 300583 - List Manager Dashboard module, 2 307638 - Campaign Creator module, 3 316994 - Attributes field, 4 I316995 - Icon Selection module, 5...

CVE-2019-11198

Multiple cross-site scripting XSS vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 300583 - List Manager Dashboard module, 2 307638 - Campaign Creator module, 3 316994 - Attributes field, 4 I316995 - Icon Selection module, 5...

CVE-2019-14670: Improper Neutralization of Input During Web Page Generation

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation...

PT-2019-13772

Name of the Vulnerable Software and Affected Versions Firefly III version 4.7.17.3 Description The issue arises from the lack of filtration of user-supplied data in the bill name field, leading to stored XSS. This occurs when the JavaScript code is executed during rule-from-bill creation...

PT-2019-11499

Name of the Vulnerable Software and Affected Versions: yaml-rust versions 0.4.0 and earlier Description: The issue is related to uncontrolled recursion, which can lead to a denial of service due to an impossible to catch abort. This occurs when the YamlLoader::load from str function is used to...

WS-2019-0611

PHP versions before 7.3.23 may attempt to read values outside of allocated buffer when raising exception inside the valid generator method while using a “yield from” statement...

WS-2019-0608

In PHP version 8.0.0RC2 a specially crafted PHP code may lead to use after free when attempting to update the node hierarchy in a multi yield from condition...

CVE-2019-1120

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1117, CVE-2019-1118, CVE-2019-1119, CVE-2019-1121, CVE-2019-1122, CVE-2019-1123, CVE-2019-1124,...