CVE-2019-17230

The OneTone theme for WordPress (versions 3.0.6 and earlier ) contains a security vulnerability in the includes/theme-functions.php file. This flaw allows unauthenticated attackers to perform unauthorized options changes , which can be used to modify site content such as 404 page messages to inje...

CVE-2019-17230: Undefined Security Weakness

includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes...

Effect Command Injection Vulnerability

effect is a node program package that allows you to add effects to your images. A command injection vulnerability exists in effect 1.0.4 and earlier. The vulnerability can be exploited to execute arbitrary commands via the options parameter...

WordPress OneTone theme <= 3.0.6 - Unauthenticated options change vulnerability

Unauthenticated options change vulnerability discovered by NinTechNet in WordPress OneTone theme versions = 3.0.6. Solution No patched version is available...

CVE-2020-7629

install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

CVE-2020-7624

effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument...

CVE-2020-7624

effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument...

Command injection

install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

Command injection

effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument...

CVE-2019-19089

For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted and displayed as different content type other than declared. A possible attack scenario would be unauthorized code execution via text...

CVE-2019-19001

For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an attacker can frame parts of the application on a malicious web site, revealing sensitive user information such as authentication credentia...

Type confusion

For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted and displayed as different content type other than declared. A possible attack scenario would be unauthorized code execution via text...

CVE-2019-19001

For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an attacker can frame parts of the application on a malicious web site, revealing sensitive user information such as authentication credentia...

CVE-2019-19089 eSOMS: X-Content-Type-Options Header Missing

For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted and displayed as different content type other than declared. A possible attack scenario would be unauthorized code execution via text...

CVE-2019-19001: Improper Restriction of Rendered UI Layers or Frames

For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an attacker can frame parts of the application on a malicious web site, revealing sensitive user information such as authentication credentia...

CVE-2020-7624: Improper Neutralization of Special Elements used in an OS Command

effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument...

Command Injection

Amendment This was deemed not a vulnerability. Overview effect is a node package that allows you to add effects on images. Affected versions of this package are vulnerable to Command Injection. The argument options can be controlled by users without any sanitization. PoC js var Root=...

Command Injection

Overview install-package is a package that installs node modules from JavaScript. Affected versions of this package are vulnerable to Command Injection. The argument options can be controlled by users without any sanitization. PoC var root = require"install-package"; root"", "& touch Song"; Detai...

CVE-2020-7629: Improper Neutralization of Special Elements used in an OS Command

install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

CVE-2019-19089: Improper Control of Generation of Code

For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted and displayed as different content type other than declared. A possible attack scenario would be unauthorized code execution via text...