2325 matches found
U.S. Dept Of Defense: █████████ - Insecure download cookie generation allows bypass of CAC authentication, access to deleted and locked files
Summary: To download a file, ████ directs users to /██████████/Download.aspx and sets a cookie authenticating the download. The cookie looks like this: pickup=Subject=&PackageID=MTU4NDgzMTU=███ If an attacker can generate this cookie, this allows downloading a file. As it turns out, the generatio...
PT-2019-18731
Name of the Vulnerable Software and Affected Versions Verydows version 2.0 Description A CSRF issue was discovered that allows adding an admin account via the "index.php?m=backend&c=admin&a=add&step=submit" endpoint, specifically by manipulating the a and step variables. Recommendations For versi...
The vulnerability of the microprogramming software for Siemens SIMATIC STEP 7 (TIA Portal) relates to the insufficient security of the database storage, allowing an attacker to retrieve passwords.
The vulnerability of the microprogramming software for Siemens SIMATIC STEP 7 TIA Portal is related to the insufficient security of the database where user credentials are stored. Exploiting this vulnerability can allow an attacker to obtain project passwords...
WordPress Mondula Multi Step Form Plugin Cross-Site Scripting Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . Mondula Multi Step Form is used in one of the drag-and-drop form builder plugin . A cross-site scripting...
CVE-2018-14846
The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php...
Cross site scripting
The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php...
CVE-2018-14846
The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php...
CVE-2018-14846
The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php...
CVE-2018-14846
CVE-2018-14846 affects WordPress users of the Mondula Multi Step Form Plugin (pre-1.2.8). The vulnerability is a stored XSS via wp-admin/admin-ajax.php, as described in multiple sources (NVD, CNVD, CVE listings). The issue stems from improper input handling in the plugin’s AJAX endpoint, enabling...
PT-2018-12759
Name of the Vulnerable Software and Affected Versions Mondula Multi Step Form plugin versions prior to 1.2.8 Description The issue concerns multiple stored XSS instances. The vulnerability can be exploited via the "wp-admin/admin-ajax.php" API endpoint. Recommendations For versions prior to 1.2.8...
CVE-2018-14846: Improper Neutralization of Input During Web Page Generation
The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php...
Design/Logic Flaw
A vulnerability has been identified in SIMATIC STEP 7 TIA Portal All Versions V15.1. Password hashes with insufficient computational effort could allow an attacker to access to a project file and reconstruct passwords. The vulnerability could be exploited by an attacker with local access to the...
CVE-2018-13811
A vulnerability has been identified in SIMATIC STEP 7 TIA Portal All Versions V15.1. Password hashes with insufficient computational effort could allow an attacker to access to a project file and reconstruct passwords. The vulnerability could be exploited by an attacker with local access to the...
CVE-2018-13811
A vulnerability has been identified in SIMATIC STEP 7 TIA Portal All Versions V15.1. Password hashes with insufficient computational effort could allow an attacker to access to a project file and reconstruct passwords. The vulnerability could be exploited by an attacker with local access to the...
CVE-2018-13811
CVE-2018-13811 affects Siemens SIMATIC STEP 7 (TIA Portal) before 15.1. The issue is unprotected storage of credentials: password hashes with insufficient computational effort can let an attacker with local access to a project file reconstruct passwords. Exploitation requires local access; no use...
CVE-2018-13811: Use of Password Hash With Insufficient Computational Effort
A vulnerability has been identified in SIMATIC STEP 7 TIA Portal All Versions V15.1. Password hashes with insufficient computational effort could allow an attacker to access to a project file and reconstruct passwords. The vulnerability could be exploited by an attacker with local access to the...
CVE-2018-19796
An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php aka submissions download page redirect parameter...
PT-2018-15098
Name of the Vulnerable Software and Affected Versions Ninja Forms plugin versions prior to 3.3.19.1 Description The issue is related to an open redirect that allows remote attackers to redirect a user. This is achieved via the "lib/StepProcessing/step-processing.php" submissions download page,...
CVE-2018-19796: URL Redirection to Untrusted Site
An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php aka submissions download page redirect parameter...
