CBAS-Web 19.0.0 - Cross-Site Request Forgery (Add Super Admin)

Exploit Title: CBAS-Web 19.0.0 - Cross-Site Request Forgery Add Super Admin Google Dork: NA Date: 2019-11-11 Exploit Author: LiquidWorm Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/ Software Link: https://www.computrols.com/building-automation-software/ Version: 19.0.0 Tested...

Debian DLA-1988-1 : ampache security update

Several vulnerabilities were discovered in Ampache, a web-based audio file management system. CVE-2019-12385 A stored XSS exists in the localplay.php LocalPlay 'add instance' functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to...

TIBCO EBX Add-on CVE-2019-17332 Cross Site Scripting Vulnerability

Description TIBCO EBX Add-on is prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let t...

CBAS-Web 19.0.0 - Cross-Site Request Forgery (Add Super Admin) Vulnerability

Exploit for hardware platform in category web applications Exploit Title: CBAS-Web 19.0.0 - Cross-Site Request Forgery Add Super Admin Exploit Author: LiquidWorm Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/ Software Link:...

Optergy 2.3.0a - Cross-Site Request Forgery (Add Admin)

Title: Optergy 2.3.0a - Cross-Site Request Forgery Add Admin Author: LiquidWorm Date: 2019-11-05 Vendor: https://optergy.com/ Product web page: https://optergy.com/products/ Affected version: history.pushState'', '', '/' input type="hidden" name=...

Optergy 2.3.0a - Cross-Site Request Forgery (Add Admin)

Optergy 2.3.0a - Cross-Site Request Forgery Add Admin Title: Optergy 2.3.0a - Cross-Site Request Forgery Add Admin Author: LiquidWorm Date: 2019-11-05 Vendor: https://optergy.com/ Product web page: https://optergy.com/products/ Affected version: history.pushState'', '', '/' input type="hidden"...

Nortek Linear eMerge E3 Access Control Cross Site Request Forgery

Nortek Linear eMerge E3 Access Control Cross-Site Request Forgery CVE: CVE-2019-7262 Advisory: https://applied-risk.com/resources/ar-2019-005 Discovered by Gjoko 'LiquidWorm' Krstic input type="hidden" name="DefaultFloorNo" valu...

TIBCO Security Advisory: November 12, 2019 - TIBCO EBX Add-on -2019-17332

TIBCO EBX Add-on For Digital Asset Manager Cross-Site Scripting Vulnerabilities Original release date: November 12,2019 Last revised: CVE-2019-17332 Source: TIBCO Software Inc. TIBCO EBX Add-on For Digital Asset Manager Cross-Site Scripting Vulnerabilities Original release date: November 12, 2019...

TIBCO Security Advisory: November 12, 2019 - TIBCO EBX Add-on -2019-17331

TIBCO EBX Add-on For Data Exchange Cross-Site Scripting Vulnerabilities Original release date: November 12,2019 Last revised: CVE-2019-17331 Source: TIBCO Software Inc. TIBCO EBX Add-on For Data Exchange Cross-Site Scripting Vulnerabilities Original release date: November 12, 2019 Last revised: -...

kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command

A flaw was found in the Linux kernel's implementation of the Bluetooth Human Interface Device Protocol HIDP. A local attacker with access permissions to the Bluetooth device can issue an IOCTL which will trigger the dohidpsockioctl function in net/bluetooth/hidp/sock.c.c. This function can leak...

ALPINE-CVE-2019-18423

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEMaddtophysmap hypercall. p2m-maxmappedgfn is used by the functions p2mresolvetranslationfault and p2mgetentry to sanity check guest physical frame. The rest of the code in the two...

UBUNTU-CVE-2019-18423

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEMaddtophysmap hypercall. p2m-maxmappedgfn is used by the functions p2mresolvetranslationfault and p2mgetentry to sanity check guest physical frame. The rest of the code in the two...

WordPress YITH WooCommerce Brands Add-On plugin <=1.3.6 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Brands Add-On plugin versions =1.3.6. Solution Update the WordPress YITH WooCommerce Brands Add-On plugin to the latest available version at least 1.3.7...

WordPress YITH WooCommerce Product Add-Ons plugin <=1.5.21 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Product Add-Ons plugin versions =1.5.21. Solution Update the WordPress YITH WooCommerce Product Add-Ons plugin to the latest available version at least 1.5.23...

MS14-082: Description of the security update for Microsoft Office 2013: December 9, 2014

MS14-082: Description of the security update for Microsoft Office 2013: December 9, 2014 Introduction This security update resolves a vulnerability that could allow remote code execution if a specially crafted file is opened in an affected edition of Microsoft Office. Summary Microsoft has releas...

PT-2019-7487 · WordPress · Easy Digital Downloads (Edd) Software Licensing Extension

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads EDD Software Licensing extension for WordPress versions 1.8.x through 1.8.6 Easy Digital Downloads EDD Software Licensing extension for WordPress versions 1.9.x through 1.9.9 Easy Digital Downloads EDD Software Licensin...

PT-2019-7485 · Edd · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads EDD versions 1.8.x through 1.8.6 Easy Digital Downloads EDD versions 1.9.x through 1.9.9 Easy Digital Downloads EDD versions 2.0.x through 2.0.4 Easy Digital Downloads EDD versions 2.1.x through 2.1.10 Easy Digital...

PT-2019-7489 · Edd · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads EDD versions 1.8.x through 1.8.6 Easy Digital Downloads EDD versions 1.9.x through 1.9.9 Easy Digital Downloads EDD versions 2.0.x through 2.0.4 Easy Digital Downloads EDD versions 2.1.x through 2.1.10 Easy Digital...

PT-2019-7492 · Pippin Williamson · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads EDD versions 1.8.x through 1.8.6 Easy Digital Downloads EDD versions 1.9.x through 1.9.9 Easy Digital Downloads EDD versions 2.0.x through 2.0.4 Easy Digital Downloads EDD versions 2.1.x through 2.1.10 Easy Digital...

PT-2019-7495 · Pippin Williamson · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads EDD versions 1.8.x through 1.8.6 Easy Digital Downloads EDD versions 1.9.x through 1.9.9 Easy Digital Downloads EDD versions 2.0.x through 2.0.4 Easy Digital Downloads EDD versions 2.1.x through 2.1.10 Easy Digital...