PT-2019-7397

Name of the Vulnerable Software and Affected Versions display-widgets plugin versions prior to 2.04 Description The issue allows for XSS via the "wp-admin/admin-ajax.php?action=dw show widget" API endpoint, specifically through the id base, widget number, or instance parameters. Recommendations F...

vBulletin Remote Command Execution Vulnerability (CNVD-2019-42750)

vBulletin is the United States InternetBrands and vBulletinSolutions, Inc. of a PHP and MySQL-based open source Web forum program . A remote command execution vulnerability exists in vBulletin versions 5.x through 5.5.4, which can be exploited by an attacker to execute commands with the help of t...

PT-2019-6135

Name of the Vulnerable Software and Affected Versions vBulletin versions 5.0.0 through 5.5.4 Description The issue is related to errors in code generation management, allowing a remote attacker to execute arbitrary commands using a specially crafted widgetConfigcode parameter in an...

CentOS Update for pango CESA-2019:2571 centos7

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-10991

The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion...

CVE-2016-10991

The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion...

Design/Logic Flaw

The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion...

CVE-2016-10991

The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion...

CVE-2016-10991

The CVE-2016-10991 entry concerns the WordPress plugin imdb-widget (before version 1.0.9) and is affected by a Local File Inclusion (LFI) vulnerability. The connected documents consistently describe the same issue across multiple sources (NVD, Red Hat, CVE lists, WPVulnDB) with the vulnerable com...

CVE-2016-10991

The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion...

PT-2019-7784

Name of the Vulnerable Software and Affected Versions imdb-widget plugin versions prior to 1.0.9 Description The issue allows for Local File Inclusion. Recommendations For versions prior to 1.0.9, update to version 1.0.9 or later to resolve the issue...

CVE-2016-10991: Improper Input Validation

The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion...

CVE-2019-10074

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never...

CVE-2019-10074

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never...

Input validation

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never...

CVE-2019-10074

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never...

CVE-2019-10074

CVE-2019-10074 affects Apache OFBiz where Freemarker markup in a Form Widget textarea can trigger remote code execution if encoding is disabled on that field (notably in the Customer Request “story” input of Order Manager). Root cause: disabling encoding on a user input field allows untrusted mar...

CVE-2019-10074: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never...

PT-2019-11418

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 16.11.06 Description: A remote code execution RCE issue is possible when Freemarker markup is entered in a textarea field of an Apache OFBiz Form Widget, specifically when encoding has been disabled on such a...

CVE-2019-15954

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution RCE on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of...