PT-2019-9286 · WordPress · Wp All Import

Name of the Vulnerable Software and Affected Versions: WP All Import plugin version 3.4.9 Description: The issue concerns an XSS vulnerability in the WP All Import plugin for WordPress, specifically via the action=options. It's noted that the vendor does not consider this a vulnerability, as the...

PT-2019-9288 · WordPress · Wp All Import

Name of the Vulnerable Software and Affected Versions: WP All Import plugin version 3.4.9 Description: The issue concerns an XSS vulnerability in the WP All Import plugin for WordPress. It can be exploited via the Add Filtering Options Add Rule feature. The vendor has stated that this is not...

WordPress WP All Import plugin cross-site scripting vulnerability (CNVD-2019-30135)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WP All Import plugin is used in one of the file import plugin. A cross-site scripting vulnerability exists in WordPress WP All Import...

PT-2019-9289 · WordPress · Wp All Import

Name of the Vulnerable Software and Affected Versions: WP All Import plugin version 3.4.9 Description: The issue concerns multiple XSS vulnerabilities. These can be accessed via the "action=template" endpoint. It's worth noting that the vendor disputes this being a vulnerability, citing that WP A...

CVE-2019-0036

When configuring a stateless firewall filter in Junos OS, terms named using the format "internal-n" e.g. "internal-1", "internal-2", etc. are silently ignored. No warning is issued during configuration, and the config is committed without error, but the filter criteria will match all packets...

GHSA-98F7-P5RC-JX67 Materialize-css vulnerable to Cross-site Scripting in tooltip component

All versions of materialize-css are vulnerable to Cross-Site Scripting. The tooltip component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript code if the malicious input is rendered by a user. Recommendation No fix is currently available. Consider...

DEBIAN-CVE-2019-8956

In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctpsendmsg" function net/sctp/socket.c when handling SCTPSENDALL flag can be exploited to corrupt memory...

PT-2019-2967 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 2.6 Description: A double-free issue exists in the idr remove all function in lib/idr.c. This can be exploited by an unprivileged local attacker to potentially escalate privileges or cause a system crash, resulting in a...

CyberAegis Aether Competition Team Reflects Bright Future for Young Women in STEM & Cybersecurity

I am always excited to get involved in conversations around getting more young women into STEM earlier. Recently, I was able to catch up with the members of the CyberAegis Aether team, an all-girls, middle school cybersecurity competition team. Here is what they had to say: Tell us a little bit...

SQL Injection Vulnerability in Joomla All Video Share Component

Joomla is an open source content management system CMS. A SQL injection vulnerability exists in the Joomla All Video Share component. The vulnerability allows attackers to obtain sensitive database information...

tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their...

CVE-2018-20753

Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild...

WordPress All-in-One WP Migration 6.83 SQL Injection

Exploit Title : WordPress All-in-One WP Migration Plugins 6.83 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 28/01/2019 Vendor Homepage : servmask.com Software Download Link : downloads.wordpress.org/plugin/all-in-one-wp-migration.6.83.zip Softwa...

Amazon Linux 2 : glibc (ALAS-2019-1140)

In the GNU C Library aka glibc or libc6 through 2.28, attempting to resolve a crafted hostname via getaddrinfo leads to the allocation of a socket descriptor that is not closed. This is related to the ifnametoindex function.CVE-2018-19591 C Tenable Network Security, Inc. The descriptive text and...

Linux/x86 - Kill All Processes Shellcode (14 bytes)

Exploit Title: Linux/x86 - Kill All Processes Shellcode 14 bytes Exploit Author: strider Vendor Homepage: None Software Link: None Tested on: Debian 9 Stretch i386/ Kali Linux i386 CVE : None Shellcode Length: 14 Description: Linux/x86 kill 9 -1 14 bytes...

Code injection

Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can be added. This attack appear to be exploitable via Crafting a value to be sent as a cookie. This vulnerability appears to have been fixed in = 1.3.5 or 1.2.5 o...

Intel QuickAssist Technology for Linux Denial of Service Vulnerability

Intel QuickAssist Technology for Linux is a Linux-based data management technology from Intel Corporation that enhances the security and compression of dynamic and static data in cloud, network, big data and storage applications. A security vulnerability exists in Intel QuickAssist Technology all...

tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their...

PHP Server Monitor 3.3.1 - Cross-Site Request Forgery

PHP Server Monitor 3.3.1 - Cross-Site Request Forgery Exploit Title: PHP Server Monitor 3.3.1 - Cross-Site Request Forgery Exploit Author: Javier Olmedo Website: https://www.sidertia.com Date: 2018-11-28 Google Dork: N/A Vendor: https://www.phpservermonitor.org/ Software Link:...

PHP Server Monitor 3.3.1 - Cross-Site Request Forgery

Exploit Title: PHP Server Monitor 3.3.1 - Cross-Site Request Forgery Exploit Author: Javier Olmedo Website: https://www.sidertia.com Date: 2018-11-28 Google Dork: N/A Vendor: https://www.phpservermonitor.org/ Software Link: https://github.com/phpservermon/phpservermon/releases/tag/v3.3.1 Affected...