Movable Type Premium vulnerable to cross-site scripting

Overview Movable Type Premium provided by Six Apart Ltd. contains a cross-site scripting vulnerability CWE-79. Six Apart Ltd. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Six Apart Ltd. coordinated under the Information Security Early Warning...

Multiple Schneider Electric Products Buffer Error Vulnerabilities

Schneider Electric Modicon Quantum and others are products of Schneider Electric, France.Schneider Electric Modicon Quantum is a large programmable logic controller PLC for process applications, high availability and safety solutions.Schneider Electric Modicon M340 is a mid-range PLC programmable...

PT-2020-6658

Name of the Vulnerable Software and Affected Versions Modicon M340 versions affected versions not specified Modicon Quantum versions affected versions not specified Modicon Premium Legacy versions affected versions not specified Communication Modules versions affected versions not specified...

Six Apart Movable Type 跨站脚本漏洞

Six Apart Movable Type MT is a blogging system from Six Apart, a US-based company. Six Apart Movable Type Premium is vulnerable to a cross-site scripting vulnerability that could be exploited by a remote authenticated attacker to inject arbitrary scripts via unspecified vectors...

Schneider Electric Modicon Quantum and Schneider Electric Modicon M340 Buffer Error Vulnerability

The Schneider Electric Modicon Quantum and Schneider Electric Modicon M340 are both products of Schneider Electric, France.The Schneider Electric Modicon Quantum is a large programmable logic controller PLC for The Schneider Electric Modicon Quantum is a large programmable logic controller PLC fo...

Multiple Schneider Electric Products Buffer Error Vulnerabilities

Schneider Electric Modicon Quantum and others are products of Schneider Electric, France.Schneider Electric Modicon Quantum is a large programmable logic controller PLC for process applications, high availability and safety solutions.Schneider Electric Modicon M340 is a mid-range PLC programmable...

PT-2020-6285

Name of the Vulnerable Software and Affected Versions Modicon M340 affected versions not specified Modicon Quantum affected versions not specified Modicon Premium Legacy affected versions not specified Description The issue is related to an out-of-bounds write vulnerability in the Web Server of t...

JVN#94245475: Movable Type Premium vulnerable to cross-site scripting

Movable Type Premium provided by Six Apart Ltd. contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on a logged-in user's web browser. Solution Update the software Update the software to the latest version according to the information provided by the...

WordPress Love Travel premium theme <= 3.8 - Unauthenticated Reflected Cross-Site Scripting (XSS) and Cross-Frame Scripting (XFS) vulnerabilities

Unauthenticated Reflected Cross-Site Scripting XSS and Cross-Frame Scripting XFS vulnerabilities found by Ex.Mi in WordPress Love Travel premium theme versions = 3.8. Solution 2020-11.12 - we were unable to find information about the patched version of this theme...

WordPress Greenmart premium theme <= 2.5.1 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability found by ErwanLR WPScan in WordPress Greenmart premium theme versions = 2.5.1. Solution Update the WordPress Greenmart premium theme to the latest available version at least 2.5.2...

WordPress Greenmart premium theme <= 2.4.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability found by Cyber Security Works Pvt. Ltd in WordPress Greenmart premium theme versions = 2.4.2. Solution Update the WordPress Greenmart premium theme to the latest available version at least 2.4.3...

openSUSE Security Update : opera (openSUSE-2020-1713)

This update for opera fixes the following issues : opera was updated to version 71.0.3770.228 - DNA-87466 Hide extensions icon is black in dark theme - DNA-88580 Implement searchintabs telemetry benchmark - DNA-88591 Allow to scroll down the Keyboards Shortcuts section with URL - DNA-88693 Random...

Command Execution Vulnerability in Scholastic Pepperdine's pc Client

Scholastic Premium is a deeply customized service-based app for Scholastic Premium students. A command execution vulnerability exists in the Scholastic Premium pc client, which can be exploited by an attacker to gain control of the server...

Stripo Inc: Able to use 'PREMIUM TEMPLATES' in 'FREE PLAN' at [https://my.stripo.email/cabinet/#/my-templates/]

Summary: Hi Team, I had found a way to use Premium Templates with FREE PLAN only. As generally Premium Templates can be only used by PAID USERS. So this will lead to heavy loss in Business. It is also possible to use components in DEMO EDITOR which are only available after registration, by just...

Realia <= 1.4 - Unauthenticated IDOR leading to Arbitrary Post Deletion

While investigating an IDOR issue on a premium theme, allowing arbitrary deletion of Ads, submitted by Vlad Vector, the Realia plugin was found to be the root cause. In fact, having this plugin installed which some themes require can allow unauthenticated attackers to delete arbitrary posts, by...

Realia <= 1.4 - Unauthenticated IDOR leading to Arbitrary Post Deletion

While investigating an IDOR issue on a premium theme, allowing arbitrary deletion of Ads, submitted by Vlad Vector, the Realia plugin was found to be the root cause. In fact, having this plugin installed which some themes require can allow unauthenticated attackers to delete arbitrary posts, by...

PT-2020-6346 · Schneider Electric · Communication Modules +3

Name of the Vulnerable Software and Affected Versions: Modicon M340 versions affected versions not specified Modicon Quantum versions affected versions not specified Modicon Premium Legacy versions affected versions not specified Communication Modules versions affected versions not specified...

Making the Edge Come Alive

In April 2019, Netflix viewers streamed 164 million hours of on-demand content per day. Fast forward a year. In April 2020, Twitch streamed 55 million hours per day. The vast majority of that was live. We have seen the future of video. It is live. But live workflows have challenges and requiremen...

YYcms has a logic flaw vulnerability (CNVD-2020-58421)

YYCMS movie and television, rain rain CMS movie and television, is a fully automatic collection of video sites. YYcms there are logical flaws vulnerability, attackers can use the vulnerability without paying any fees to open VIP package year, time with their own definition...

WordPress WPBakery Page Builder premium plugin <= 6.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by Chloe Chamberland in WordPress WPBakery Page Builder premium plugin versions = 6.4. Solution Update the WordPress WPBakery Page Builder premium plugin to the latest available version at least 6.4.1...