3390 matches found
CVE-2019-12516: Improper Neutralization of Special Elements used in an SQL Command
The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI...
CVE-2019-13923: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway All versions. The integrated configuration web server of the affected device could allow Cross-Site Scripting XSS attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for ...
CVE-2019-15867: Use of Hard-coded Credentials
The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13 password for the slickpopupteam account, after a Subscriber calls a certain AJAX action...
CVE-2019-11701: Improper Neutralization of Input During Web Page Generation
The default webcal: protocol handler will load a web site vulnerable to cross-site scripting XSS attacks. This default was left in place as a legacy feature and has now been removed. Note: this issue only affects users with an account on the vulnerable service. Other users are unaffected.. This...
CVE-2018-20155: Missing Authorization
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings...
CVE-2018-6960: Improper Authentication
VMware Horizon DaaS 7.x before 8.0.0 contains a broken authentication vulnerability that may allow an attacker to bypass two-factor authentication. Note: In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS...
CVE-2017-7255: Improper Neutralization of Input During Web Page Generation
XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1title parameter. Someone must login to conduct the attack...
CVE-2017-7257: Improper Neutralization of Input During Web Page Generation
XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1content parameter. Someone must login to conduct the attack...
CVE-2017-7256: Improper Neutralization of Input During Web Page Generation
XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1summary parameter. Someone must login to conduct the attack...