3897 matches found
Oracle Web Services CVE-2019-2907 Remote Security Vulnerability
Description Oracle Web Services is prone to a remote security vulnerability. The vulnerability can be exploited over the 'HTTP' protocol. The 'SOAP with Attachments API for Java' component is affected. This vulnerability affects the following supported versions: 12.2.1.3.0 Technologies Affected...
PT-2019-3745
Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.3.0 Description The issue is related to inadequate access control in the SOAP with Attachments API for Java component of Oracle WebLogic Server, part of the Oracle Fusion Middleware platform. This can be...
CVE-2015-9464: Improper Limitation of a Pathname to a Restricted Directory
The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter...
PT-2019-7423
Name of the Vulnerable Software and Affected Versions s3bubble-amazon-s3-html-5-video-with-adverts plugin version 0.7 Description The issue concerns directory traversal via the path parameter in the "adverts/assets/plugins/ultimate/content/downloader.php" API endpoint. This allows unauthorized...
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with OpenPages GRC Platform (CVE-2019-4268)
Summary IBM WebSphere Application Server is shipped as a component of OpenPages GRC Platform. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin IBM WebSphere...
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with OpenPages GRC Platform (CVE-2019-4477)
Summary IBM WebSphere Application Server is shipped as a component of OpenPages GRC Platform. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin IBM WebSphere...
Exclusive — Hacker Steals Over 218 Million Zynga 'Words with Friends' Gamers Data
A Pakistani hacker who previously made headlines earlier this year for selling almost a billion user records stolen from nearly 45 popular online services has now claimed to have hacked the popular mobile social game company Zynga Inc. With a current market capitalization of over $5 billion, Zyng...
Exclusive — Hacker Steals Over 218 Million Zynga 'Words with Friends' Gamers Data
A Pakistani hacker who previously made headlines earlier this year for selling almost a billion user records stolen from nearly 45 popular online services has now claimed to have hacked the popular mobile social game company Zynga Inc. With a current market capitalization of over $5 billion, Zyng...
How Trump’s Ukraine Mess Entangled CrowdStrike
A US cybersecurity company became a topic of interest for President Donald Trump in his call with Ukraine’s Volodymyr Zelensky...
CVE-2019-6839
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in U.motion Server MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15, which could allow a...
CVE-2019-6839: Unrestricted Upload of File with Dangerous Type
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in U.motion Server MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15, which could allow a...
GitLab: Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests
I've found a three minor vulnerabilities which, when combined, allow an attacker to copy private repositories, confidential issues, private snippets, and then some. I'll go through the code path to explain the vulnerabilities and how they are combined. See the Proof of Concept section if you want...
CVE-2019-15328
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS...
Cross site scripting
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS...
Cross site request forgery (csrf)
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF...
CVE-2019-15326
The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal...
CVE-2019-15327
The CVE-2019-15327 vulnerability affects the WordPress plugin import-users-from-csv-with-meta (pre-1.14.1.3). The issue is an XSS via data imported into the plugin. Public documents indicate a fix in version 1.14.1.3 (VendorFix). The vulnerability is documented across multiple sources (NVD, Red H...
CVE-2019-15327
The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data...