PT-2019-18787

Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description A reflected cross-site scripting issue exists in the Product widget chooser functionality in the admin panel...

CVE-2019-7862: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...

CVE-2019-14297

Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...

CVE-2019-14297

Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...

CVE-2019-14297

Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...

CVE-2019-14297

Veeam ONE Reporter 9.5.0.3201 is affected by a cross-site scripting vulnerability. The issue arises in the Add/Edit Widget functionality where a crafted value in the Caption field can impact setDashboardWidget in CommonDataHandlerReadOnly.ashx, indicating insufficient input validation/encoding in...

CVE-2019-14297: Improper Neutralization of Input During Web Page Generation

Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...

PT-2019-20532

This module provides an autocomplete widget for text fields that suggests all existing previously entered values for that field. The module doesn't sufficiently check for proper access permission before returning autocomplete results. This vulnerability is mitigated by the fact that an attacker...

Atlassian Confluence 6.14.x < 6.14.2 Multiple Vulnerabilities

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.6.12, 6.7.x prior to 6.12.3, 6.13.x prior to 6.13.3, or 6.14.x prior to 6.14.2. It is, therefore, affected by the following vulnerabilities : - A server-side request forger...

Atlassian Confluence 6.13.x < 6.13.3 Multiple Vulnerabilities

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.6.12, 6.7.x prior to 6.12.3, 6.13.x prior to 6.13.3, or 6.14.x prior to 6.14.2. It is, therefore, affected by the following vulnerabilities : - A server-side request forger...

CVE-2019-13413

The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontrewidget.php...

CVE-2019-13414

The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontrewidget.php...

PT-2019-13326 · Rencontre · Rencontre

Name of the Vulnerable Software and Affected Versions: Rencontre plugin versions prior to 3.1.3 Description: The issue allows for XSS attacks. This is due to a problem in the inc/rencontre widget.php file. Recommendations: For versions prior to 3.1.3, update to version 3.1.3 or later to resolve t...

PT-2019-13325 · Rencontre · Rencontre

Name of the Vulnerable Software and Affected Versions: Rencontre plugin versions prior to 3.1.3 Description: The issue allows SQL Injection via the inc/rencontre widget.php file. Recommendations: For versions prior to 3.1.3, update to version 3.1.3 or later to resolve the issue...

WordPress 2by2host Widget Logic Plugin Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. 2by2host Widget Logic plugin is a web widget control plugin used in it. A cross-site request forgery vulnerability exists in the...

WordPress Widget Logic plugin <= 5.9.0 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability that leads to Remote Code Execution RCE found by Paul Dannewitz in WordPress Widget Logic plugin versions = 5.9.0. Solution Update the WordPress Widget Logic plugin to the latest available version at least 5.10.2...

WordPress Widget Logic plugin <= 5.10.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found in WordPress Widget Logic plugin versions = 5.10.2. Solution Update the WordPress Widget Logic plugin to the latest available version at least 5.10.3...

CVE-2019-12826

A Cross-Site-Request-Forgery CSRF vulnerability in widgetlogic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers to execute PHP code via snippets that are attached to widgets and then eval'd to dynamically determine their visibility by crafting a maliciou...

CVE-2019-12826

A Cross-Site-Request-Forgery CSRF vulnerability in widgetlogic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers to execute PHP code via snippets that are attached to widgets and then eval'd to dynamically determine their visibility by crafting a maliciou...

Cross site request forgery (csrf)

A Cross-Site-Request-Forgery CSRF vulnerability in widgetlogic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers to execute PHP code via snippets that are attached to widgets and then eval'd to dynamically determine their visibility by crafting a maliciou...