Wing FTP Server 6.2.3 Cross Site Request Forgery

Exploit Title: Wing FTP Server 6.2.3 - Authenticated Cross Site Request Forgery Date: 2020-03-10 Exploit Author: Dhiraj Mishra Vendor Homepage: https://www.wftpserver.com Version: v6.2.6 Tested on: Windows 10 Summary: An authenticated CSRF exists in web client and web administration of Wing FTP...

Sentrifugo HRMS 3.2 - id SQL Injection

Sentrifugo HRMS 3.2 - id SQL Injection Exploit Title: Sentrifugo HRMS 3.2 - 'id' SQL Injection Exploit Author: minhnb Website: Date: 2020-03-06 Google Dork: N/A Vendor: http://www.sapplica.com Software Link: http://www.sentrifugo.com/download Affected Version: 3.2 and possibly before Patched...

Sentrifugo HRMS 3.2 - 'id' SQL Injection

Exploit Title: Sentrifugo HRMS 3.2 - 'id' SQL Injection Exploit Author: minhnb Website: Date: 2020-03-06 Google Dork: N/A Vendor: http://www.sapplica.com Software Link: http://www.sentrifugo.com/download Affected Version: 3.2 and possibly before Patched Version: unpatched Category: Web Applicatio...

Joplin Desktop 1.0.184 - Cross-Site Scripting

Joplin Desktop 1.0.184 - Cross-Site Scripting Exploit Title: Joplin Desktop 1.0.184 - Cross-Site Scripting Exploit Author: Javier Olmedo Date: 2020-02-27 Vendor: Laurent Cozic Software Link: https://github.com/laurent22/joplin/archive/v1.0.184.zip Affected Version: 1.0.184 and before Patched...

WordPress Reality theme <= 2.5.1 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability found by m0ze in WordPress Reality premium theme versions = 2.5.1. Solution 2020 February 7 - the theme is no more available on Theme forest, we were unable to find information about the patched version...

GHSA-763G-FQQ7-48WG XML external entity (XXE) processing ('external-parameter-entities' feature was not fully disabled))

Due to an incomplete fix for CVE-2019-9658, checkstyle was still vulnerable to XML External Entity XXE Processing. Impact User: Build Maintainers This vulnerability probably doesn't impact Maven/Gradle users as, in most cases, these builds are processing files that are trusted, or pre-vetted by a...

PYSEC-2020-258

In TensorFlow before 1.15.2 and 2.0.1, converting a string from Python to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode. This issue can lead to denial of service in inference/training where a malicious attacker c...

GHSA-R2WF-Q3X4-HRV9 Default development error handler in Ratpack is vulnerable to HTML content injection (XSS)

Versions of Ratpack from 0.9.10 through 1.7.5 are vulnerable to CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' aka. XSS in the development error handler. An attacker can utilize this to perform XSS when an exception message contains untrusted data. As a...

WordPress Postie plugin <= 1.9.40 - Stored Cross-Site Scripting (XSS) and post submission spoofing vulnerabilities

Stored Cross-Site Scripting XSS and post submission spoofing vulnerabilities found by V1n1v131r4 in WordPress Postie plugin versions = 1.9.40. Solution 06.01.2020 - we were unable to find a patched version of this plugin...

WordPress Scoutnet Kalender plugin <= 1.1.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found by Simon Moser in WordPress Scoutnet Kalender plugin versions = 1.1.0. Solution 11.12.2019 - we were unable to find a patched version of this plugin...

GHSA-35FR-H7JR-HH86 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria

Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response. Impact 1. Cross-User Defacement 2. Cache...

WordPress CSS Hero 4.0.3 Cross Site Scripting

Team, Document Title =============== CVE-2019-19133 Reflected XSS in CSS Hero = v.4.0.3 WordPress plugin. Product Description =============== CSS Hero WordPress Plugin A live WordPress Theme editor that works without modifying any of your theme files. Very low performance footprint: only generate...

WordPress Social Photo Gallery plugin <= 1.0 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability found by Prestigia Seguridad in WordPress Social Photo Gallery plugin versions = 1.0. Solution 19.11.2019 - we were unable to find a patched version of this plugin...

PT-2022-8289 · Podman +2 · Podman +2

Name of the Vulnerable Software and Affected Versions: Podman and Varlink version 1.5.1 Description: A critical issue was found, affecting an unknown part of the component API. This leads to Remote Privilege Escalation and can be initiated remotely. The exploit has been disclosed publicly...

Insecure Password Storage in Zingbox Inspector

A security vulnerability exists in Zingbox Inspector that results in passwords for 3rd party integrations being stored in cleartext in device configuration. Ref: CVE-2019-15023 The vulnerability allows for the viewing of plaintext credentials stored within the Zingbox Inspector software and store...

Remote Command Injection in Zingbox Inspector

A security vulnerability exists in Zingbox Inspector that allows for remote code execution if the Inspector were sent a malicious command from the Zingbox cloud, or if the Zingbox Inspector were tampered with to connect to an attacker's cloud endpoint. Ref: CVE-2019-1584 This vulnerability can on...

SQL Injection in Zingbox Inspector

An SQL injection vulnerability exists in the Zingbox Inspector management interface that allows for unsanitized data provided by an authenticated user to be passed from the web UI into the database. Ref: CVE-2019-15016 The vulnerability allows for authenticated users to pass unsanitized commands ...

U.S. Dept Of Defense: [CVE-2018-0296] Cisco VPN path traversal on the https://███████/ (██████)

The Cisco VPN was found to be vulnerable to a path traversal vulnerability CVE-2018-0296. The vulnerability allowed an unauthenticated attacker to access sensitive information such as VPN sessions and files...

PT-2019-7738 · Pagelines +1 · Pagelines +1

Name of the Vulnerable Software and Affected Versions: PageLines theme version 1.1.4 Description: The issue concerns a CSRF vulnerability in the PageLines theme for WordPress. It affects the "wp-admin/admin-post.php?page=pagelines" endpoint. Recommendations: For PageLines theme version 1.1.4,...

WordPress Qwizcards plugin <= 3.36 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability found by Ricardo Sanchez in WordPress Qwizcards plugin versions = 3.36. Solution 10 September 2019 - we were unable to find a patched version of this plugin...