CVE-2019-15954

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution RCE on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of...

CVE-2019-15954: Total.js CMS 12 Widget Remote Code Execution

Total.js is a Node.js Framework for building e-commerce applications, REST services, real-time apps, or apps for Internet of Things IoT, etc. Total.js CMS is a Content Management System application that is part of the Total.js framework. A commercial version is also available, and can be seen use...

Totaljs CMS 12.0 Widget Creation Code Injection

Author/Discoverer: Riccardo Krauter @CertimeterGroup + Title: Totaljs CMS Authenticated Code injection on widget creation. + Affected software: Totaljs CMS 12.0 + Description: An authenticated user with “widgets” privilege can gain RCE on the remote server by creating a malicious widget with a...

Total.js CMS 12 Widget JavaScript Code Injection

This module exploits a vulnerability in Total.js CMS. The issue is that a user with admin permission can embed a malicious JavaScript payload in a widget, which is evaluated server side, and gain remote code execution. Module Options msf use exploit/multi/http/totaljs/cmswidgetexec msf...

CVE-2016-10919

The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::addsiteurl method, a different vulnerability than CVE-2012-2633...

Security feature bypass

The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::addsiteurl method, a different vulnerability than CVE-2012-2633...

CVE-2016-10919

The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::addsiteurl method, a different vulnerability than CVE-2012-2633...

WordPress rimons-twitter-widget plugin cross-site scripting vulnerability

WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports personal blog sites on PHP and MySQL servers. rimons-twitter-widget is a plugin used in it to crawl posts on Twitter. A cross-site scripting vulnerability exists in the WordPress...

PT-2019-7715

Name of the Vulnerable Software and Affected Versions Wassup plugin versions prior to 1.9.1 Description The issue concerns a cross-site scripting XSS vulnerability. It can be exploited via the Top stats widget or the wassupURI::add siteurl method. Recommendations For versions prior to 1.9.1, upda...

CVE-2016-10919: Improper Neutralization of Input During Web Page Generation

The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::addsiteurl method, a different vulnerability than CVE-2012-2633...

Fedora Update for pango FEDORA-2019-547be4a683

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2017-18533

The rimons-twitter-widget plugin before 1.3 for WordPress has XSS...

Cross site scripting

The rimons-twitter-widget plugin before 1.3 for WordPress has XSS...

CVE-2017-18533

The Red Hat and other feeds confirm CVE-2017-18533 is an XSS vulnerability in the Rimons Twitter Widget WordPress plugin, affecting versions before 1.3. The vulnerability arises in the rimons-twitter-widget plugin for WordPress and is documented by multiple sources (NVD, CNVD, PRION, CVE listings...

CVE-2017-18533

The rimons-twitter-widget plugin before 1.3 for WordPress has XSS...

PT-2019-8467

Name of the Vulnerable Software and Affected Versions rimons-twitter-widget plugin versions prior to 1.3 Description The issue affects the rimons-twitter-widget plugin for WordPress, allowing for cross-site scripting XSS attacks. Recommendations For versions prior to 1.3, update the...

CVE-2017-18533: Improper Neutralization of Input During Web Page Generation

The rimons-twitter-widget plugin before 1.3 for WordPress has XSS...

CVE-2019-7862

A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...

Cross site scripting

A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...

The vulnerability of the Widget Connector web server component in Atlassian Confluence Server exists due to an incorrect path name limitation for the restricted access directory. This allows attackers to execute arbitrary code.

The vulnerability of the Widget Connector component in the Atlassian Confluence Server exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...