8078 matches found
CVE-2019-19982
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...
Design/Logic Flaw
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...
CVE-2019-19982
The CVE-2019-19982 entry concerns the WordPress plugin Email Subscribers & Newsletters prior to version 4.2.3 . The vulnerability allows unauthenticated option creation when an attacker sends a request to /wp-admin/admin-post.php?es_skip=1&option_name= , enabling modification of plugin options wi...
CVE-2019-19982
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...
WordPress Email Subscribers & Newsletters Unauthenticated Options Creation Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. An unauthenticated option creation...
PT-2019-16032
Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters versions prior to 4.2.3 Description The issue allows for unauthenticated option creation. To exploit this, an attacker would need to send a request to the "wp-admin/admin-post.php?es skip=1&option name=" endpoin...
CVE-2019-19982: Improper Authentication
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...
CVE-2019-18263: Inadequate Encryption Strength
An issue was found in Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, Veradius Unity 718132 with wireless option shipped between 2016-August 2018, Veradius Unity 718132 with ViewForum option shipped between 2016-August 2018, Pulsera 718095 and Endura 718075 with wireless option shipp...
UBUNTU-CVE-2019-19232
In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo as ...
CVE-2019-17527: Improper Neutralization of Special Elements used in an SQL Command
dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the index.php?option=comjsjobs&task=customfields.getfieldtitlebyfieldandfieldfo child parameter...
Security Bulletin: Cross frame scripting vulnerability in Connect:Enterprise HTTP (CVE-2013-6327)
Summary IBM Sterling Connect:Enterprise HTTP Option is vulnerable to cross frame scripting attacks. Vulnerability Details CVE ID: CVE-2013-6327 DESCRIPTION: IBM Sterling Connect:Enterprise HTTP Option could allow a cross-frame scripting attack, caused by improper validation of input within a fram...
PT-2019-14301
Name of the Vulnerable Software and Affected Versions node-df versions 0.1.4 and earlier Description A code injection issue exists that can allow an attacker to achieve remote code execution through unsanitized input. The package fails to sanitize filenames passed to the file option, which may...
Design/Logic Flaw
An issue was discovered in the SAML Single Sign On SSO plugin for several Atlassian products affecting versions 3.1.0 through 3.2.2 for Jira and Confluence, versions 2.4.0 through 3.0.3 for Bitbucket, and versions 2.4.0 through 2.5.2 for Bamboo. It allows locally disabled users to reactivate thei...
UBUNTU-CVE-2014-0212
qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors...
CVE-2019-16776
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended nodemodules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or ga...
CVE-2019-16775
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenodemodules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package...
CVE-2019-16777
Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of...
CVE-2019-16776
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended nodemodules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or ga...
Linear pagetable use / entry miscounts
ISSUE DESCRIPTION "Linear pagetables" is a technique which involves either pointing a pagetable at itself, or to another pagetable of the same or higher level. Xen has limited support for linear pagetables: A page may either point to itself, or point to another pagetable of the same level i.e., L...