PT-2019-15200

Name of the Vulnerable Software and Affected Versions Blog2Social plugin versions prior to 5.9.0 Description The issue allows an attacker to execute arbitrary HTML and JavaScript code via the b2s id parameter. This occurs in the views/b2s/post.calendar.php component when the Administrator is logg...

CVE-2014-1214: Unrestricted Upload of File with Dangerous Type

views/upload.php in the ProJoom Smart Flash Header NovaSFH component 3.0.2 and earlier for Joomla! allows remote attackers to upload and execute arbitrary files via a crafted 1 dest parameter and 2 arbitrary extension in the Filename parameter...

CVE-2019-17550: Improper Neutralization of Input During Web Page Generation

The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the b2sid parameter. The component is: views/b2s/post.calendar.php. The attack vector is: When the Administrator is logge...

CVE-2019-9757

An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read...

CVE-2019-16967: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form html\admin\modules\manager\views\form.php, an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via G...

CVE-2016-11013

The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS...

PT-2019-7806

Name of the Vulnerable Software and Affected Versions wp-listings plugin versions prior to 2.0.2 Description The issue is related to an XSS problem in the includes/views/single-listing.php file of the wp-listings plugin for WordPress. Recommendations For versions prior to 2.0.2, update to version...

CVE-2016-11013: Improper Neutralization of Input During Web Page Generation

The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS...

PT-2019-20100

Name of the Vulnerable Software and Affected Versions Opera versions prior to 63.0.3368.88 Description The issue concerns several problems fixed in an Opera update, including a crash at views::MenuController::FindNextSelectableMenuItem, issues with continuous packages using new mac bundle...

CVE-2019-10395

Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.145, 2.138.1, or older, exploitable by users able to change various job/build properties...

CVE-2019-11464

Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however some information security professionals additionally look for X-Permitted-Cross-Domain-Policies and...

PT-2019-12324

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 5.1.2 through 5.5.0 Description The issue concerns the absence of certain security-related headers in REST responses from the Couchbase Server Views REST API. Specifically, headers such as X-Frame-Options,...

CVE-2019-11464: Improper Neutralization of Input During Web Page Generation

Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however some information security professionals additionally look for X-Permitted-Cross-Domain-Policies and...

CVE-2019-14679: Cross-Site Request Forgery (CSRF)

core/views/arpriceimportexport.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arpliteimportexport CSRF...

Schben Adive Privilege Control Vulnerability

Schben Adive is a PHP-based web development framework . A security vulnerability exists in the Internal/Views/addUsers.php file in Schben Adive version 2.0.7. A remote attacker can exploit this vulnerability to create administrator privileges with admin/user/add...

CVE-2019-14346

CVE-2019-14346 affects Schben Adive 2.0.7. The vulnerability is a Cross-Site Request Forgery in Internal/Views/config.php that allows an admin/config CSRF to change a user password due to insufficient validation of request origin. Root cause stated as Web application not adequately validating tru...

PT-2019-13625

Name of the Vulnerable Software and Affected Versions Schben Adive version 2.0.7 Description The issue allows for admin/config CSRF, enabling an attacker to change a user's password. This is possible due to a vulnerability in the Internal/Views/config.php file. Recommendations For Schben Adive...

CVE-2019-14347: Direct Request

Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users editor or developer to create an administrator account via admin/user/add, as demonstrated by a Python PoC script...

CVE-2019-14346: Cross-Site Request Forgery (CSRF)

Internal/Views/config.php in Schben Adive 2.0.7 allows admin/config CSRF to change a user password...

PT-2019-11756 · Jenkins · Jenkins Maven Release Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Maven Release Plugin versions 0.14.0 and earlier Description: A stored cross site scripting issue allows attackers to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins. Variables on affected views are no...