268 matches found
Newsletter Lite < 4.6.19 - Multiple Issues
- Lack of CSRF, Authorisation and sanitisation checks in the ajaxloadneweditor function, registered as an AJAX method, can lead to an authenticated reflected XSS issue. - Authenticated Directory Traversal leading to RCE PoC XSS: As an authenticated user with a role as low as a Subscriber, open...
LiveChat <= 3.7.2 - Unauthenticated Option Update/Reset and Stored XSS
The lack of proper CSRF and Authorisation checks could allow an unauthenticated attacker to update or reset the plugin's settings. Furthermore, when updating the livechatemail option, no sanitisation is performed, leading to a Stored XSS issue in the plugin's settings page. CSRF and XSS fixed in...
Authentication flaw
The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check...
Authentication flaw
The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check...
Information disclosure in the BrowseProjects.jspa resource - CVE-2019-3399
The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check...
Information disclosure in the ManageFilters.jspa resource - CVE-2019-3401
The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check...
Information disclosure in the ManageFilters.jspa resource - CVE-2019-3401
The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check...
Information disclosure in the /rest/api/2/user/picker rest resource - CVE-2019-3403
The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check...
Authorisation bypass in the ViewUpgrades resource - CVE-2019-8443
The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator's session to access the ViewUpgrades administrative resource without needing to...
Ads for WP <= 1.5 - XSS & Lack of Authorisation
The Ads for WP – Advanced Ads & Adsense Solution for WP & AMP WordPress plugin was affected by a XSS & Lack of Authorisation security vulnerability...
Online Accessibility <= 2.0.10 - CSRF and lack of Authorisation in AJAX methods
The Accessibility Suite by Online ADA WordPress plugin was affected by a CSRF and lack of Authorisation in AJAX methods security vulnerability...
Super-systemic IoT flaws
IoT security flaws were always systemic: by that I mean that if I find a flaw in my smart thermostat, it affects ALL of those thermostats. A security problem with one connected car leads to problems with ALL the connected cars using that same system. That led to incidents such as the Mirai botnet...
utp.mrsk-cp.ru XSS vulnerability
Open Bug Bounty ID: OBB-636868 Description| Value ---|--- Affected Website:| utp.mrsk-cp.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Shibboleth 2 XML Injection
Advisory: Truncation of SAML Attributes in Shibboleth 2 RedTeam Pentesting discovered that the shibd service of Shibboleth 2 does not extract SAML attribute values in a robust manner. By inserting XML entities into a SAML response, attackers may truncate attribute values without breaking the...
CVE-2017-15391
Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to access Extension pages without authorisation via a crafted HTML page...
WooCommerce Stock Manager <= 1.0.7 - CSRF and Lack of Authorisation
Missing CSRF and Authorisation checks in the stockmanagersaveoneproductstockdata method registered as an AJAX call...
WordPress Simple Download Monitor Plugin <= 3.2.8 - Insufficient Authorisation
Because of this vulnerability, any user can access the "sdmtinygetpostids" action which will return a JSON encoded list of all "postid"and "posttitle" that were uploaded with this plugin. Solution Upgrade the plugin...
Edimax BR6228nS/BR6228nC - Multiple Vulnerabilities
Title: Edimax BR6228nS/BR6228nC - Multiple vulnerabilities Date: 01.09.15 Vendor: edimax.com Firmware version: 1.22 Author: Smash Contact: smash at devilteam.pl Few vulnerabilities found in Edimax BR6228nS/BR6228nC router firmware. 1/ Cross Site Scripting Request: POST /goform/formWizSetup HTTP/1...
CVE-2015-4136: SSH Authorisation permitted for a user with hard-coded credentials in Windows Stock Image (Windows Server 2012 R2) AMI
In Bamboo 5.8.0 and 5.8.1 the Windows Stock Image Windows Server 2012 R2 AMI contain a 'bamboo' user which is configured with a publicly known password. While the 'bamboo' user is not allowed RDP access it was permitted to login through SSH on instances using the affected AMI. In the event that a...