242 matches found
Easy Breadcrumb - Critical - Cross Site Scripting - SA-CONTRIB-2019-053
This module enables you to use the current URL path alias and the current page's title to automatically extract the breadcrumb's segments and its respective links then show them as breadcrumbs on your website. The module doesn't sufficiently sanitise user input in certain circumstances. This...
WordPress Breadcrumb NavXT Plugin Information Disclosure
A vulnerability exists in WordPress Breadcrumb NavXT plugin. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information...
WordPress Breadcrumb NavXT plugin <= 6.1.0 - Username Disclosure via REST API
Username Disclosure via REST API issue found by Janek Vind in WordPress Breadcrumb NavXT plugin versions = 6.1.0. Solution Update the WordPress Breadcrumb NavXT plugin to the latest available version at least 6.2.0...
Wordpress Plugin Breadcrumb NavXT Username Information Disclosure Vulnerability
WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. Wordpress plugin Breadcrumb NavXT suffers from a username information disclosure vulnerability, which can be exploited by attackers to launch password brute-force...
Breadcrumb NavXT <= 6.1.0 - Username Disclosure via REST API
The Breadcrumb NavXT WordPress plugin was affected by an Username Disclosure via REST API security vulnerability. http://www.example.com/wp-json/bcn/v1/author/1...
WordPress Breadcrumb NavXT 6.1.0 Username Disclosure
Exploit for php platform in category web applications Username Disclosure in Breadcrumb NavXT Wordpress plugin ============================================================ Author: Janek Vind "waraxe" Date: 26. September 2018 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-108.html...
PT-2018-12627
Name of the Vulnerable Software and Affected Versions moodle versions prior to 3.5.2 moodle versions prior to 3.4.5 moodle versions prior to 3.3.8 Description The issue concerns a reflected XSS vulnerability due to insufficient filtering of the search parameter in the breadcrumb navigation provid...
CVE-2016-4872
Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projects via a breadcrumb trail...
Authentication flaw
Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projects via a breadcrumb trail...
CVE-2016-4872
Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projects via a breadcrumb trail...
CVE-2016-4872
Cybozu Office versions 9.0.0–10.4.0 contain a breadcrumb-trail based access restrictions bypass (CVE-2016-4872). Remote authenticated attackers can bypass restrictions and view the names of unauthorized projects. This is a user‑capability exposure rather than a full remote execution issue. Mitiga...
CVE-2016-4872: Exposure of Sensitive Information to an Unauthorized Actor
Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projects via a breadcrumb trail...
Breadcrumb trail in Cybozu Office vulnerable vulnerable to browse restriction bypass
Overview Cybozu Office provided by Cybozu,Inc. contains a browse restriction bypass vulnerability in the breadcrumb trail. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the Information Security Early...
CVE-2015-4378
Cross-site scripting XSS vulnerability in the Crumbs module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the "Administer Crumbs" permission to inject arbitrary web script or HTML via a custom breadcrumb separator...
CVE-2015-4378: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Crumbs module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the "Administer Crumbs" permission to inject arbitrary web script or HTML via a custom breadcrumb separator...
Restricted blog post visible in the month summary page
Steps to reproduce: 1. create a new blog post, and restrict it to yourself 2. log in as another user and go to Blogs in sidebar 3. blog is not visible in the blogs summary page 4. click a visible blog in the same month 5. click the month link in the breadcrumb 5. restricted blog title and excerpt...
Restricted blog post visible in the month summary page
Steps to reproduce: 1. create a new blog post, and restrict it to yourself 2. log in as another user and go to Blogs in sidebar 3. blog is not visible in the blogs summary page 4. click a visible blog in the same month 5. click the month link in the breadcrumb 5. restricted blog title and excerpt...
Restricted blog post visible in the month summary page
Steps to reproduce: 1. create a new blog post, and restrict it to yourself 2. log in as another user and go to Blogs in sidebar 3. blog is not visible in the blogs summary page 4. click a visible blog in the same month 5. click the month link in the breadcrumb 5. restricted blog title and excerpt...
