1508 matches found
CVE-2018-14573: Improper Limitation of a Pathname to a Restricted Directory
A Local File Inclusion LFI vulnerability exists in the Web Interface API of TightRope Media Carousel Digital Signage before 7.3.5. The RenderingFetch API allows for the downloading of arbitrary files through the use of directory traversal sequences, aka CSL-1683...
PT-2018-12587
Name of the Vulnerable Software and Affected Versions TightRope Media Carousel Digital Signage versions prior to 7.3.5 Description A Local File Inclusion LFI issue exists in the Web Interface API, specifically affecting the RenderingFetch API. This allows for the downloading of arbitrary files...
Woocommerce Category Banner Management <= 1.1.0 - Unauthenticated Settings Change
The WooCommerce Banner and Carousel Slider for Category, Page WordPress plugin was affected by an Unauthenticated Settings Change security vulnerability...
Cross-site Scripting (XSS)
primefaces is vulnerable to multiple cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization for the values of the following views: tabView, carousel, dataGrid, dataList, pickList, commandButton...
bootstrap_carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2017-088
This module provides a way to make carousels, based on bootstrap-carousel.js. The module doesn't sufficiently handle output of img HTML tag's alt property. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Carousel: Create new content" or any simil...
Wordpress pondol-carousel plugin cross-site scripting vulnerability
WordPress is the WordPress Software Foundation's suite of blogging platforms developed using the PHP language, which supports the hosting of personal blog sites on servers running PHP and MySQL. pondol-carousel is one of the plugins used to create a folder. A cross-site scripting vulnerability...
CVE-2016-1000145
Reflected XSS in wordpress plugin pondol-carousel v1.0...
CVE-2016-1000145
Reflected XSS in wordpress plugin pondol-carousel v1.0...
Cross site scripting
Reflected XSS in wordpress plugin pondol-carousel v1.0...
CVE-2016-1000145
CVE-2016-1000145 affects the WordPress pondol-carousel plugin (v1.0). The vulnerability is a Cross-Site Scripting (XSS) flaw in the plugin’s admin flow, traced to unsanitized data in the variable like itemid being sent back to the user’s browser (admin_create.php). This can allow an attacker to i...
CVE-2016-1000145
Reflected XSS in wordpress plugin pondol-carousel v1.0...
PT-2016-4537
Name of the Vulnerable Software and Affected Versions pondol-carousel version 1.0 Description The issue is related to a Reflected XSS in the wordpress plugin. Recommendations For version 1.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability...
CVE-2016-1000145: Improper Neutralization of Input During Web Page Generation
Reflected XSS in wordpress plugin pondol-carousel v1.0...
WordPress Carousel Slideshow Plugin - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...
WordPress Carousel Slideshow Plugin - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...
WordPress Pondol Carousel Plugin <= 1.0 - Cross Site Scripting (XSS)
Because of this vulnerability, the variable "itemid" appears to send unsanitized data back to the users browser. Vulnerable file is /pondol-carousel/pages/admincreate.php. Solution Update the plugin...
Thumbnail Carousel Slider < 1.0.1 - Stored Cross-Site Scripting (XSS) & CSRF
The original advisory states that this vulnerability is exploitable with editor and author roles but this is incorrect. Only the administrator role by default can trigger this vulnerability. However, CSRF on the image upload form makes this exploitable by a malicious actor...
WordPress Kiwi Logo Carousel Plugin <= 1.7.1 - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Vulnerable parameter is "tabflagsorder". Solution Update this plugin...
WordPress Kiwi Logo Carousel Plugin <= 1.7.1 - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Vulnerable parameter is "tabflagsorder". Solution Update this plugin...