WordPress Plugin "WordPress Ultra Simple Paypal Shopping Cart" vulnerable to cross-site request forgery

Overview WordPress Plugin "WordPress Ultra Simple Paypal Shopping Cart" provided by Mike Castro Demaria contains a cross-site request forgery vulnerability CWE-352. Yuta Kikuchi of Cryptography Laboratory,Department of Information and Communication Engineering,Tokyo Denki University reported this...

Pricing Table < 2.3 - Cross-Site Request Forgery

Lack of CSRF checks could allow attackers to make logged in users perform unwanted actions, such as arpliteimportexport...

WordPress Plugin "HTML5 Maps" vulnerable to cross-site request forgery

Overview WordPress Plugin "HTML5 Maps" provided by Fla-Shop.com contains a cross-site request forgery vulnerability CWE-352. Daisuke Shimizu of Cryptography Laboratory,Department of Information and Communication Engineering,Tokyo Denki University directly reported this vulnerability to the...

WordPress Plugin "Related YouTube Videos" vulnerable to cross-site request forgery

Overview WordPress Plugin "Related YouTube Videos" provided by Chris Doerr contains a cross-site request forgery vulnerability CWE-352. Shoichiro Ishikawa of Cryptography Laboratory,Department of Information and Communication Engineering,Tokyo Denki University directly reported this vulnerability...

WordPress Plugin "Contest Gallery" vulnerable to cross-site request forgery

Overview WordPress Plugin "Contest Gallery" provided by Contest-Gallery contains a cross-site request forgery vulnerability CWE-352. Okazawa Yoshihiro of Cryptography Laboratory,Department of Information and Communication Engineering,Tokyo Denki University directly reported this vulnerability to...

WordPress Xunjin Themes Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A cross-site request forgery vulnerability exists in WordPress Xunjin Themes, where an...

Cybozu Garoon Privilege Access Control Issue Vulnerability (CNVD-2019-12697)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A vulnerability exists in Cybozu Garoon versions 4.0.0 to 4.10.1 due to privilege permission and access control...

WordPress plugin LearnPress open to redirection vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An open redirection vulnerability exists in the WordPress plugin LearnPress, where accessing a crafted URL may cause logged-i...

OpenAM (Open Source Edition) Session Management Vulnerability

OpenAM is an open source access management, authorization services platform. A session management vulnerability exists in OpenAM Open Source Edition. An attacker could exploit the vulnerability to change security questions and reset login passwords for users logged into the product...

CVE-2018-18086

EmpireCMS v7.5 has an arbitrary file upload vulnerability in the LoadInMod function in e/class/moddofun.php, exploitable by logged-in users...

CVE-2018-18086

EmpireCMS v7.5 has an arbitrary file upload vulnerability in the LoadInMod function in e/class/moddofun.php, exploitable by logged-in users...

Privilege escalation

EmpireCMS v7.5 has an arbitrary file upload vulnerability in the LoadInMod function in e/class/moddofun.php, exploitable by logged-in users...

CVE-2018-18086

EmpireCMS v7.5 is affected by CVE-2018-18086 due to an arbitrary file upload vulnerability in the LoadInMod function of e/class/moddofun.php, exploitable by logged-in users. The issue is documented in multiple sources (NVD entry and related records). The connected documents confirm the vulnerable...

CVE-2018-18086

EmpireCMS v7.5 has an arbitrary file upload vulnerability in the LoadInMod function in e/class/moddofun.php, exploitable by logged-in users...

Cybozu Garoon vulnerable to directory traversal

Overview Cybozu Garoon provided by Cybozu, Inc. contains a directory traversal vulnerability CWE-22 due to a flaw in processing of the session information. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated und...

VLC media player arbitrary code execution vulnerability (CNVD-2018-12841)

VLC media player is a well-known multimedia player that can play video and audio in many formats. An arbitrary code execution vulnerability exists in VLC media player that allows attackers to execute arbitrary code in the context of a logged-in user via a crafted MKV file...

CVE-2018-11119

ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 redirects a logged-in user to a third-party site via the returntourl parameter...

ExpressionEngine: Import File Converter - local File inclusion

@lawrenceamer discovered a local file inclusion vulnerability that logged in users with access to the control panel and permission to access developer utilities may be able to exploit. @lawrenceamer gave a detailed report with step-by-step instructions for replicating and screen captures of a the...

Cybozu Garoon Browsing Restriction Bypass Vulnerability (CNVD-2018-08809)

Cybozu Garoon is an office software with Chinese, Japanese, and English languages. A browsing restriction bypass vulnerability exists in the application "Cabinet" in Cybozu Garoon 3.5.0 through 4.6.1. The vulnerability can be exploited by users who can log in to the product to view folder names...

Cybozu Garoon Browsing Restriction Bypass Vulnerability

Cybozu Garoon is an office software with Chinese, Japanese, and English languages. A browsing restriction bypass vulnerability exists in the application "Space" in Cybozu Garoon 4.0.0 through 4.6.0. The vulnerability can be exploited by users who can log in to the product to view the closed...