6807 matches found
PT-2019-7252
Name of the Vulnerable Software and Affected Versions all-in-one-wp-security-and-firewall plugin versions prior to 3.9.8 Description The issue concerns a Cross-Site Scripting XSS flaw in the unlock request feature of the plugin. This type of flaw allows attackers to inject malicious scripts into...
PT-2019-7664
Name of the Vulnerable Software and Affected Versions all-in-one-wp-security-and-firewall plugin versions prior to 4.0.5 Description The issue concerns the all-in-one-wp-security-and-firewall plugin for WordPress, which has a cross-site scripting XSS problem. This problem is found in the blacklis...
PT-2019-7253
Name of the Vulnerable Software and Affected Versions all-in-one-wp-security-and-firewall plugin versions prior to 3.9.5 Description The issue concerns a cross-site scripting XSS problem in the add query arg and remove query arg function instances. This could potentially allow attackers to inject...
CVE-2015-9294: Improper Neutralization of Input During Web Page Generation
The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in addqueryarg and removequeryarg function instances...
CVE-2015-9293: Improper Neutralization of Input During Web Page Generation
The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature...
CVE-2016-10866: Improper Neutralization of Input During Web Page Generation
The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues...
CVE-2016-10867: Improper Neutralization of Input During Web Page Generation
The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages...
CVE-2016-10868: Improper Neutralization of Input During Web Page Generation
The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages...
WordPress Deny All Firewall plugin cross-site request forgery vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in versions of the WordPress Deny All Firewall plugin prior to 1.1.7, which...
CVE-2019-14681
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=dafsettings&dafremove=true CSRF...
CVE-2019-14681
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=dafsettings&dafremove=true CSRF...
Cross site request forgery (csrf)
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=dafsettings&dafremove=true CSRF...
CVE-2019-14681
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=dafsettings&dafremove=true CSRF...
CVE-2019-14681
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=dafsettings&dafremove=true CSRF...
CVE-2019-14681
CVE-2019-14681 affects the WordPress plugin Deny All Firewall up to version 1.1.6. The flaw is a CSRF in wp-admin/options-general.php?page=daf_settings&daf_remove=true that an attacker could trigger to perform unintended actions on behalf of an authenticated admin. Impact states partial confident...
PT-2019-13777
Name of the Vulnerable Software and Affected Versions Deny All Firewall plugin versions prior to 1.1.7 Description The issue allows for a CSRF attack via the wp-admin/options-general.php?page=daf settings&daf remove=true endpoint, potentially affecting the security of WordPress installations usin...
CVE-2019-14681: Cross-Site Request Forgery (CSRF)
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=dafsettings&dafremove=true CSRF...
tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their...
CVE-2016-10797: Exposure of Sensitive Information to an Unauthorized Actor
cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains SEC-133...