6710 matches found
CVE-2019-7903: Undefined Security Weakness
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to email templates can execute arbitrary code by previewing a malicious template...
PT-2019-18808
Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description An information disclosure issue exists, allowing an authenticated user with privileges to create email templates to...
Code Execution Vulnerability in ZZCMS2019
ZZCMS with product investment templates, you can quickly build product investment website. For example, the pharmaceutical investment industry, health care investment industry, cosmetics investment industry, agricultural investment industry, pregnancy and child investment industry, alcohol and fo...
CVE-2019-14387
cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates SEC-506...
CVE-2019-14387
cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates SEC-506...
Cross site scripting
cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates SEC-506...
CVE-2019-14387
CVE-2019-14387 affects cPanel before 82.0.2, with a Self XSS vulnerability in the cPanel and webmail master templates (SEC-506). Root cause is client-side script execution via crafted input in template code. Impact, per CVSS data, is MEDIUM: network access with exploitation requiring user interac...
Command execution vulnerability in PbootCMS v1.4.1 frontend search page template
PbootCMS is a new core and permanent open source free PHP enterprise website development and construction management system, is a set of efficient, simple, strong and free commercial PHP CMS source code. PbootCMSv1.4.1 front-end search page templates have a command execution vulnerability that ca...
PT-2019-13656
Name of the Vulnerable Software and Affected Versions cPanel versions prior to 82.0.2 Description The issue concerns a Self XSS in the cPanel and webmail master templates. Recommendations For versions prior to 82.0.2, update to version 82.0.2 or later to resolve the issue...
CVE-2019-14387: Improper Neutralization of Input During Web Page Generation
cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates SEC-506...
The evolution of Microsoft Threat Protection—July update
Modern security teams need to proactively, efficiently, and effectively hunt for threats across multiple attack vectors. To address this need, today we’re excited to give you a glimpse of a new threat hunting capability coming soon to Microsoft Threat Protection. Building off the threat hunting...
Cross-site Scripting in invenio-communities
Cross-Site Scripting XSS vulnerability in Jinja templates Impact A Cross-Site Scripting XSS vulnerability was discovered in two Jinja templates in the Invenio-Communities module. The vulnerability allows a user to create a new community and include script element tags inside the description and...
GHSA-MFV8-Q39F-MGFG Cross-site Scripting in invenio-communities
Cross-Site Scripting XSS vulnerability in Jinja templates Impact A Cross-Site Scripting XSS vulnerability was discovered in two Jinja templates in the Invenio-Communities module. The vulnerability allows a user to create a new community and include script element tags inside the description and...
PT-2019-11621
Name of the Vulnerable Software and Affected Versions: Invenio-Communities versions prior to 1.0.0a20 Description: A Cross-Site Scripting XSS issue was found in the Invenio-Communities module, specifically in two Jinja templates. This issue allows a user to create a new community and include scri...
CVE-2019-9886
Any URLs with downloadattachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1...
Gitlab -- Multiple Vulnerabilities
Gitlab reports: Ability to Write a Note to a Private Snippet Recent Pipeline Information Disclosed to Unauthorised Users Resource Exhaustion Attack Error Caused by Encoded Characters in Comments Authorization Issues in GraphQL Number of Merge Requests was Accessible Enabling One of the Service...
New Relic: CSTI fix (#587829) bypass leading to stored XSS at plugins again
@skavans discovered a workaround for previous XSS mitigations. This led to a more robust approach to filtering dangerous content in Angular templates...
PRODSECBUG-2306: Remote code execution through crafted email templates
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...