CVE-2018-14014: Cross-Site Request Forgery (CSRF)

In waimai Super Cms 20150505, there is a CSRF vulnerability that can add an admin account via admin.php?m=Member&a=adminadd...

PT-2018-12278

Name of the Vulnerable Software and Affected Versions waimai Super Cms version 20150505 Description The issue allows for the addition of an admin account via the admin.php?m=Member&a=adminadd API endpoint, due to a CSRF vulnerability. Recommendations For waimai Super Cms version 20150505, as a...

my.sporx.com XSS vulnerability

Open Bug Bounty ID: OBB-643284 Description| Value ---|--- Affected Website:| my.sporx.com Open Bug Bounty Program:| View Open Bug Bounty Program Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

DEBIAN-CVE-2018-13405

The inodeinitowner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigge...

WordPress Ultimate Member plugin cross-site scripting vulnerability (CNVD-2018-12768)

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL server set up a personal blog site. ultimate Member aka ultimatemember is one of the plug-ins used to create a member site or online community. A...

CVE-2018-13136

The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...

Design/Logic Flaw

The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...

CVE-2018-13136

The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...

CVE-2018-13136

The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...

CVE-2018-13136

CVE-2018-13136 affects the WordPress plugin Ultimate Member (aka ultimatemember) for versions prior to 2.0.18, exposing a cross-site scripting (XSS) vulnerability via the wp-admin settings screen. The issue is documented across multiple sources (CNVD/EUVD/OpenVAS/NVD/CVE records) as an XSS in thi...

CVE-2018-13136

The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...

CVE-2018-13136: Improper Neutralization of Input During Web Page Generation

The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...

PT-2018-11625

Name of the Vulnerable Software and Affected Versions The Ultimate Member plugin versions prior to 2.0.18 Description The issue allows for XSS via the wp-admin settings screen. Recommendations For versions prior to 2.0.18, update to version 2.0.18 or later to resolve the issue...

Ultimate Member < 2.0.18 - Authenticated Cross-Site Scripting (XSS)

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

manttus.com XSS vulnerability

Open Bug Bounty ID: OBB-635414 Description| Value ---|--- Affected Website:| manttus.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Security Bulletin: Potential Security exposure with WebSphere Application Server (CVE-2014-3070)

Summary There is a potential bypass security vulnerability in WebSphere Application Server Version 8.0 and higher with Virtual Member Manager VMM. Vulnerability Details CVEID: CVE-2014-3070 Description: WebSphere Application Server could allow a remote attacker to bypass security restrictions...

forumromanum.de XSS vulnerability

Open Bug Bounty ID: OBB-628249 Description| Value ---|--- Affected Website:| forumromanum.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-11554: Exposure of Sensitive Information to an Unauthorized Actor

The forgotten-password feature in index.php/member/reset/resetemail.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force...

PT-2018-10662

Name of the Vulnerable Software and Affected Versions YzmCMS versions 3.2 through 3.7 Description The issue concerns the forgotten-password feature in the index.php/member/reset/reset email.html file, which has a Response Discrepancy Information Exposure problem. Additionally, the verification co...

muscleappeal.com XSS vulnerability

Open Bug Bounty ID: OBB-627218 Description| Value ---|--- Affected Website:| muscleappeal.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...