PT-2019-19886

Name of the Vulnerable Software and Affected Versions Doorkeeper::OpenidConnect versions 1.4.x through 1.5.3 Description The issue allows for an open redirect via the redirect uri field in an OAuth authorization request, resulting in an error response when the 'openid' scope and a prompt=none val...

CVE-2019-9844: Improper Neutralization of Input During Web Page Generation

simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI...

Atlassian SourceTree 0.5a < 3.0.17 Multiple remote code execution vulnerabilities

The version of Atlassian SourceTree installed on the remote Windows host is version 0.5a prior to 3.0.17. It is, therefore, affected by multiple remote code execution vulnerabilities. - An option injection vulnerability exists in the git submodule component. An unauthenticated, remote attacker ca...

March 12, 2019—KB4489878 (Monthly Rollup)

March 12, 2019—KB4489878 Monthly Rollup Applies To Windows 7 Service Pack 1 Windows Server 2008 R2 Service Pack 1 Improvements and fixes This security update includes improvements and fixes that were a part of update KB4486565 released February 19, 2019 and addresses the following issues: Address...

March 12, 2019—KB4489886 (OS Build 16299.1029)

March 12, 2019—KB4489886 OS Build 16299.1029 Applies To Windows 10, version 1709, all editions Note Reminder: March 12th and April 9th will be the last two Delta updates for Windows 10, version 1709. Security and quality updates will continue to be available via the express and full cumulative...

CVE-2018-20236

There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using Sourcetree for Windows to exploit this issue to gain code execution on the system...

CVE-2018-20236

There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using Sourcetree for Windows to exploit this issue to gain code execution on the system...

CVE-2018-20236

CVE-2018-20236 affects Sourcetree for Windows: a URI-handling vulnerability in versions older than 3.0.10 allows unauthenticated remote attackers to supply a malicious URI that yields code execution on the victim’s system. Affected: Sourcetree for Windows before 3.0.10 (0.5a–3.0.9). Remediation: ...

CVE-2018-20236: Improper Neutralization of Special Elements used in a Command

There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using Sourcetree for Windows to exploit this issue to gain code execution on the system...

PT-2019-10029

Name of the Vulnerable Software and Affected Versions: Sourcetree for Windows versions 0.5a through 3.0.9 Description: A command injection issue exists via URI handling, allowing a remote attacker to send a malicious URI to a victim using Sourcetree for Windows, potentially leading to code...

CVE-2018-17425

WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI...

CVE-2018-17425

WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI...

CVE-2018-17426

WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI...

CVE-2018-17425

WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI...

CVE-2018-17426

WUZHI CMS 4.1.0 is affected by a stored XSS vulnerability in the Extension module, specifically the "SMS in station" field under index.php?m=core. The issue is caused by improper input handling in that field, enabling arbitrary HTML/JS injection. No exploit details or remediation are provided in ...

CVE-2019-3778

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

CVE-2019-9625

DirectAdmin 1.55 is vulnerable to a Cross-Site Request Forgery (CSRF) via the CMD_ACCOUNT_ADMIN URI, enabling an attacker to create a new admin account. The flaw is triggered in scenarios where an authenticated admin visits a crafted page or form that issues a POST to /CMD_ACCOUNT_ADMIN, as descr...

CVE-2019-9625

JBMC DirectAdmin 1.55 allows CSRF via the /CMDACCOUNTADMIN URI to create a new admin account...

CVE-2019-9613

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadVideo URI...

CVE-2019-9617

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadFile URI...