CVE-2018-20613

TEMMOKU T1.09 Beta allows admin/user/add CSRF...

CVE-2018-20613

CVE-2018-20613 is described as a CSRF issue in TEMMOKU T1.09 Beta that could allow admin/user/add actions. The connected documents do not provide concrete technical details (no affected versions, root cause, impact, or fixes) beyond noting CSRF. No exploitation details are present in the provided...

beta.medworm.com XSS vulnerability

Open Bug Bounty ID: OBB-714983 Description| Value ---|--- Affected Website:| beta.medworm.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

1Password for macOS Information Disclosure Vulnerability

1Password for macOS is a macOS-based application for storing and managing personal passwords. An information disclosure vulnerability exists in version 7.2.3.BETA prior to 1Password 7.2.3.BETA-3 for macOS-based platforms, which can be exploited by attackers to obtain sensitive information...

Frappe ERPNext SQL Injection Vulnerability (CNVD-2019-17163)

Frappe ERPNext is an open source ERP Enterprise Resource Planning system. The system includes functions for financial management, inventory management, customer relationship management, project management and human resource management. A SQL injection vulnerability exists in Frappe ERPNext versio...

beta-tools.com XSS vulnerability

Open Bug Bounty ID: OBB-709946 Description| Value ---|--- Affected Website:| beta-tools.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

beta-wp.itsu.com XSS vulnerability

Open Bug Bounty ID: OBB-707762 Description| Value ---|--- Affected Website:| beta-wp.itsu.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

CVE-2018-19859

OpenRefine before 3.2 beta is vulnerable to directory traversal via a relative pathname in a ZIP archive (CVE-2018-19859). The issue is confirmed across multiple advisories linking to OpenRefine's project import path handling. Mitigation known in the connected docs includes patches suggested by P...

Nmap Web Dashboard and Reporting: WebMap

Features Import and parse Nmap XML files Statistics and Charts on discovered services, ports, OS, etc… Inspect a single host by clicking on its IP address Attach labels on a host Insert notes for a specific host Create a PDF Report with charts, details, labels and notes Copy to clipboard as Nikto...

CVE-2018-19133

CVE-2018-19133 involves Flarum Core 0.1.0-beta.7.1, where a flaw leads to exposure of user email addresses (PII). The connected Red Hat/GHSA entries reinforce the same description of a privacy leak, but the provided documents do not specify the root cause details, affected code paths, or a remedi...

CVE-2018-9208

Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut = v1.1Beta...

OracleVM 3.3 / 3.4 : nss (OVMSA-2018-0264)

The remote OracleVM system is missing necessary patches to address critical security updates : - Added nss-vendor.patch to change vendor - Temporarily disable some tests until expired PayPalEE.cert is renewed - Backport upstream fix for CVE-2018-12384 - Remove nss-lockcert-api-change.patch, which...

D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ D-Link Central WiFiManager Software Controller Multiple Vulnerabilities 1. Advisory Information Title: D-Link Central WiFiManager Software Controller Multiple Vulnerabilities Advisory ID: CORE-2018-0010 Advisory URL:...

Inedo ProGet Cross-Site Scripting Vulnerability

Inedo ProGet is a general-purpose package manager from Inedo USA with package management, filtering and upgrading features. A cross-site scripting vulnerability exists in Inedo ProGet versions prior to 5.0 Beta5. A remote attacker can exploit the vulnerability to change advanced settings...

CVE-2017-15608

Inedo ProGet before 5.0 Beta5 has CSRF, allowing an attacker to change advanced settings...

marshmallow library for Python Information Disclosure Vulnerability

Python is an open source, object-oriented programming language from the Python Software Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. marshmallow library is one of the lightweight libraries for converting complex objects into Python data...

Beers with Talos EP 37: Snort 3 Beta Uses Multithreading. It’s Super Effective!

Beers with Talos BWT Podcast Ep. 37 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast. Ep. 37 show notes: Recorded Sept. 7, 2018 — We have Joel back this week and he is very happy to have himse...

Ogma CMS Cross-Site Request Forgery Vulnerability

Ogma CMS is an XML-based flat file content management system CMS. A cross-site request forgery vulnerability exists in the users.php?action=createnew page in Ogma CMS version 0.4 Beta, which can be exploited by remote attackers to add an administrator account...

YesWiki PHP Object Injection Vulnerability

YesWiki is a Wiki system written in PHP. The system is primarily used to create and manage websites in a collaborative manner. A PHP object injection vulnerability exists in the deserialization process of user input parameters in the i18n.inc.php file in YesWiki cercopitheque beta 1 and earlier...

FlightAirMap Cross-Site Scripting Vulnerability

FlightAirMap is a free, open source application developed using PHP for displaying flights on a map. A cross-site scripting vulnerability exists in the GET variable on the Registration sub-menu page in FlightAirMap 1.0-beta.21 and earlier versions. A remote attacker can exploit this vulnerability...