PT-2019-14553 · Limesurvey · Limesurvey

Name of the Vulnerable Software and Affected Versions: LimeSurvey versions prior to 3.17.14 Description: The issue allows for reflected XSS, enabling the escalation of privileges from a low-privileged account to a higher-privileged one, such as SuperAdmin. This occurs in the application/core/Surv...

WordPress simple-301-redirects-addon-bulk-uploader plugin redirection vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. simple-301-redirects-addon-bulk-uploader is used in one of the Simple 301 Redirects redirect plugin to provide extended...

WordPress insta-gallery plugin operates as authorized vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. insta-gallery is a plugin for displaying personal social networks. A security vulnerability exists in WordPress insta-gallery plugin...

Former Cross-Site Scripting Vulnerability

Former is a form builder for frameworks like Laravel. A cross-site scripting vulnerability exists in Former versions prior to 4.2.1, which can be exploited by an attacker to execute client-side code...

CVE-2019-5395

A remote arbitrary file upload vulnerability was discovered in HPE 3PAR Service Processor versions: prior to 5.0.5.1...

cPanel Access Control Error Vulnerability (CNVD-2019-29607)

cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in versions of cPanel prior to 68.0.15. An attacker can exploit the vulnerability to...

cPanel cross-site scripting vulnerability (CNVD-2019-26003)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in the WHM cPAddons installation interface in versions prior to cPanel 62.0.24. The...

CVE-2019-7909

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...

CVE-2018-20931

cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page SEC-405...

CVE-2018-20877

cPanel before 74.0.8 allows self XSS in WHM Style Upload interface SEC-437...

cPanel Information Disclosure Vulnerability (CNVD-2019-25328)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An information disclosure vulnerability exists in versions of cPanel prior to 78.0.18. The vulnerability stems from an error in t...

cPanel cross-site scripting vulnerability (CNVD-2019-26366)

cPanel is a set of the most prestigious commercial software in the web hosting industry, which is based on Linux and BSD system, developed in PHP and closed-source software in nature, providing powerful and quite complete hosting management functions. A stored cross-site scripting vulnerability...

CVE-2019-11921

An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformed binary content in Structured HTTP Headers. This issue affects versions of proxygen prior to v2019.07.22.00...

CVE-2019-1010234

The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending malicious http request to the controller. The component is: Method runJavaCompiler in YangLiveCompilerManager.java. The attack vector is:...

Foxit PhantomPDF Denial of Service Vulnerability (CNVD-2019-24196)

PhantomPDF is a multifunctional PDF editor. A denial of service vulnerability exists in Foxit PhantomPDF versions prior to 8.3.11 when calling the clone function. The vulnerability stems from an infinite loop caused by an obfuscation of the relationship between the factor object and the parent...

DEBIAN-CVE-2019-5831

Object lifecycle issue in V8 in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

DEBIAN-CVE-2019-5786

Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page...

CVE-2018-6142

Array bounds check failure in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file...

UBUNTU-CVE-2019-5831

Object lifecycle issue in V8 in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2019-12292

Citrix AppDNA before 7 1906.1.0.472 has Incorrect Access Control...