CVE-2016-10979

The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS...

CVE-2016-10979

The CVE-2016-10979 entry concerns the fossura-tag-miner WordPress plugin prior to version 1.1.5, which is vulnerable to Cross-Site Scripting (XSS). Root cause is an XSS flaw in the plugin that could affect site users; the vulnerability is documented across multiple sources (NVD, Red Hat and CVE l...

CVE-2016-10978

CVE-2016-10978 affects the fossura-tag-miner WordPress plugin (pre-1.1.5). The connected documents consistently describe a CSRF vulnerability in this plugin. Public details confirm the affected product and vulnerability class, but do not provide further exploit vectors, affected platforms beyond ...

CVE-2016-10978

The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF...

Mozilla: XSS by breaking out of title and textarea elements using innerHTML

Some HTML elements, such as title and textarea, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if...

Microsoft SharePoint Remote Code Execution Vulnerability (CNVD-2019-34772)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code executi...

Kilo Buffer Overflow Vulnerability

Kilo is a text editor with syntax highlighting and search capabilities. A Kilo buffer overflow vulnerability exists in Kilo version 0.0.1, which stems from an integer overflow involving the calculation of the number of tags in a line. No details of the vulnerability are available at this time...

News Wrap: Deepfake CEO Voice Scam, Facebook Phone Data Exposed

In this week’s news wrap ended Sept. 6, the Threatpost team breaks down the biggest news of the week, including: Cybercrooks successfully fooling a company into a large wire transfer using an AI-powered deepfake of a chief executive’s voice and Facebook, Microsoft and a number of universities...

CVE-2019-15954

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution RCE on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of...

Fedora 29 : nfdump (2019-9013b5e75d)

2019-08-14 - Fix compile issues - Fix output buffer size for lzo1xdecompresssafe 2019-08-07 - Fix VerifyExtensionMap 179 2019-08-06 - Fix compile errors 2019-08-05 - Fix nfdump.1 man page. 175 - Fix off by 1 array. 173 - Fix use after free in ModifyCompressFile - Add bound checks in AddExporterSt...

php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exifprocessIFDTAG function. This may lead to information disclosure or crash...

openwsman security update

2.6.5-5 - Fix CVE-2019-3816 Resolves: 1693972 - Remove Dist Tag from the oldest changelog entry...

CVE-2019-14371

An issue was discovered in Libav 12.3. There is an infinite loop in the function movprobe in the file libavformat/mov.c, related to offset and tag...

Design/Logic Flaw

An issue was discovered in Libav 12.3. There is an infinite loop in the function movprobe in the file libavformat/mov.c, related to offset and tag...

CVE-2019-14371

An issue was discovered in Libav 12.3. There is an infinite loop in the function movprobe in the file libavformat/mov.c, related to offset and tag...

CVE-2019-14371

An issue was discovered in Libav 12.3. There is an infinite loop in the function movprobe in the file libavformat/mov.c, related to offset and tag...

SQL Injection Vulnerability in Five Fingers CMS Backend Tag Management Service

Five Fingers CMS is a professional content management system. Five Fingers CMS backend tag management system has SQL injection vulnerability, attackers can exploit the vulnerability to obtain database information...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data in budget name, allowing an attacker to inject malicious script in a transaction to get executed on the tags/show/$tagnumber$ tag summary page...

CVE-2019-13644

Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction, and is executed on the tags/show/$tagnumber$ tag summary page. NOTE: It is asserted that an attacker must have the same acce...

Design/Logic Flaw

DISPUTED Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction, and is executed on the tags/show/$tagnumber$ tag summary page. NOTE: It is asserted that an attacker must have the...