Cisco Web Security Appliance CVE-2019-15956 Unauthorized Access Vulnerability

Description Cisco Web Security Appliance is prone to an unauthorized-access vulnerability. Attackers can exploit this issue to gain unauthorized access and perform unauthorized actions. This may aid in further attacks. This issue is being tracked by Cisco Bug ID CSCvp51493. Technologies Affected...

PT-2019-3976

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance WSA affected versions not specified Description A vulnerability in the web-based management interface of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct cross-site...

PT-2019-3963

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance WSA versions affected versions not specified Description A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance could allow an authenticated, remote attacker to...

CVE-2019-8232

In Magento, versions affected include 1.x up to 1.9.4.3, 1.14.4.3, 2.2 up to 2.2.10, and 2.3 up to 2.3.3 or 2.3.2-p1. The issue is a race condition that, when an authenticated admin uses the import feature, enables arbitrary code execution by modifying the webserver configuration file. This is th...

girlgames.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1007899 Security Researcher MrRain1996 Helped patch 959 vulnerabilities Received 4 Coordinated Disclosure badges Received 9 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting girlgames.com website and...

experten-branchenbuch.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1007363 Security Researcher Faizanmark Helped patch 77 vulnerabilities Received 6 Coordinated Disclosure badges Received 58 recommendations , a holder of 6 badges for responsible and coordinated disclosure, found a security vulnerability affecting experten-branchenbuch.de...

minasshopping.com.br Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1007130 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Worry-free cms has arbitrary file deletion vulnerability

Worry-free cms is one of the most professional, most used, most widely used small website builder system for small and medium-sized enterprises to build their own website. Worry-free cms arbitrary file deletion vulnerability, an attacker can take advantage of the vulnerability to arbitrary file...

election.iu.edu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1004930 Security Researcher devl00p Helped patch 3025 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting election.iu.edu website...

Imgur: De-anonymization Attack: Cross Site Information Leakage

Dear Imgur Security Team, We are researchers at the IMDEA Software Institute in Madrid, Spain. We have been working on analyzing Cross-Site Browser Leaks xsleaks and building a tool for finding instances of it on target web sites. Recently we tested imgur.com and discovered a flaw that can affect...

org.apache.nifi:nifi-cluster-authorization-provider (0.0.2-incubating), org.apache.nifi:nifi-framework-cluster (0.0.2-incubating) +5 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.0.2-incubating)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.0.2-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider...

org.apache.nifi:nifi-cluster-authorization-provider (0.7.0), org.apache.nifi:nifi-framework-cluster (0.7.0) +6 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.7.0)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider 0.7.0 -...

org.apache.nifi:nifi-cluster-authorization-provider (0.4.1), org.apache.nifi:nifi-framework-cluster (0.4.1) +6 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.4.1)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider 0.4.1 -...

org.apache.nifi:nifi-cluster-authorization-provider (0.5.1), org.apache.nifi:nifi-framework-cluster (0.5.1) +6 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.5.1)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider 0.5.1 -...

CVE-2019-5122

YouPHPTube 7.6 exposes authenticated SQL injection vulnerabilities in /objects/pluginSwitch.json.php (parameters uuid, name, dir). The Talos report confirms exploitable injections that could exfiltrate information such as usernames and password hashes and, in some configs, access the underlying O...

CVE-2019-5121

YouPHPTube 7.6 contains authenticated SQL injection vulnerabilities in the /objects/pluginSwitch.json.php endpoint (parameter uuid, name, dir). TALOS documentation describes exploitable, authenticated SQL injections that could exfiltrate database data and, in certain configurations, access the OS...

CVE-2019-5117

CVE-2019-5117 corresponds to an authenticated SQL injection in YouPHPTube 7.6, specifically in /objects/subscribe.json.php (parameter user_id). Exploitation requires being logged in; a crafted request can exfiltrate database content and user credentials, with potential OS access in some configura...

CVE-2019-5116

CVE-2019-5116 is a SQL injection vulnerability in YouPHPTube 7.6, present in the authenticated portion of the application. The TALOS/YouPHPTube advisory describes an exploitable flaw in the /objects/videoAddNew.json.php endpoint (parameter categories_id) that can exfiltrate database information (...

Wordpress Groundhogg SQL Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. Wordpress Groundhogg suffers from a SQL injection vulnerability that can be exploited by attackers to execute illegal SQL...

CVE-2019-18419

The provided connected records confirm CVE-2019-18419 is a cross-site scripting (XSS) flaw in ClonOS WEB control panel 19.09, specifically in index.php with the lang parameter. Root cause is described in CNVD as lack of proper validation of client-side data, enabling injection of arbitrary script...