CVE-2014-5140: Improper Neutralization of Special Elements used in an SQL Command

The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : colon characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book...

Server-Side Template Injection

pebble is vulnerable to server-side template injection. The fix for an older vulnerability that validates for getClass can be bypassed to inject arbitrary code through the template using Java classes that have TYPE static field containing values that is an instance of java.lang.Class. For example...

Arbitrary Code Execution

odata-client-proxy is vulnerable to arbitrary code execution. The vulnerability exists as the classes that were deserialized were not checked in AbstractService, allowing unsafe deserialization that can lead to arbitrary code execution...

Important: Red Hat Security Advisory: Red Hat Data Grid 7.3.2 security update

An update for Red Hat Data Grid is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Remote Code Execution

jackson-databind is vulnerable to remote code execution. The application does not block the xalan classes during deserialization, which would allow a remote attacker to leverage the vulnerability to execute arbitrary code...

CVE-2018-2602

It was discovered that the I18n component of OpenJDK could use an untrusted search path when loading resource bundle classes. A local attacker could possibly use this flaw to execute arbitrary code as another local user by making their Java application load an attacker controlled class file...

CVE-2019-16931: Improper Neutralization of Input During Web Page Generation

A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers...

Critical severity vulnerability that affects generator-jhipster

Account takeover and privilege escalation is possible in applications generated by generator-jhipster before 6.3.0. This is due to a vulnerability in the generated java classes: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator PRNG Generated applications must be manually...

GHSA-MWP6-J9WF-968C Critical severity vulnerability that affects generator-jhipster

Account takeover and privilege escalation is possible in applications generated by generator-jhipster before 6.3.0. This is due to a vulnerability in the generated java classes: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator PRNG Generated applications must be manually...

CVE-2019-15822: Improper Limitation of a Pathname to a Restricted Directory

The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal...

CVE-2019-15321

The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled...

CVE-2019-15321

The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled...

CVE-2019-15321

CVE-2019-15321 applies to the WordPress plugin “Option Tree” prior to version 2.7.3, where an Object Injection vulnerability arises from mishandled serialized classes. The entry is documented across multiple sources (NVD description: “option-tree plugin before 2.7.3 for WordPress has Object Injec...

jackson-databind: arbitrary code execution in slf4j-ext class

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using slf4j classes. An attacker could use this flaw to execute arbitrary code...

jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using blaze classes. An attacker could use this flaw to execute arbitrary code...

AlwaysOn Availability Groups cannot be selected while restoring a SQL database to Microsoft SQL Server 2017 after installation of CU15

Challenge You try to restore a SQL database to Microsoft SQL Server 2017 with CU15 that supports AlwaysOn Availability Groups, but you are not able to select an availability group at the "Specify AlwaysON Restore Options" step. Cause ServerNetworkProtocolProperty is missing in CU15 for SQL Server...

CVE-2019-10257

Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location dot-dot-slash notation to access files or directories that are elsewhere on the system. Through this vulnerability it is possible to read the application's java...

SD-WAN QoS - FAQ

1. What are the different QoS components? 1. IP Rules 2. QoS classes 3. Application QoS. 2. What type of traffic is allocated by default to different Classes? In the SD-WAN environment, we think of applications as falling into one of the following three classes: Real-time –VoIP or VoIP like...

Intensio-Obfuscator - Obfuscate A Python Code 2.X And 3.X

Takes a python source code and transform it into an obfuscated python code, replace name of variables - classes - functions to random chars and defined length, removes comments, line breaks and add to each line a random script with an always differents values. Requirement Python = 3.5 Files...

CVE-2019-12241: Deserialization of Untrusted Data

The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php...