CVE-2017-18538

The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes...

CVE-2017-18538

The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes...

Design/Logic Flaw

The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes...

Design/Logic Flaw

The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes...

Design/Logic Flaw

The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes...

CVE-2017-18539

The CVE-2017-18539 entry concerns the WordPress WebLibrarian plugin. Affected component: weblibrarian plugin (WordPress) prior to version 3.4.8.6. Root cause: cross-site scripting (XSS) via front-end short codes. Impact: attacker can execute client-side code; exact impact details are described ac...

CVE-2017-18539

The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes...

CVE-2017-18538

The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes...

Webmin 1.920 Remote Root Exploit

Exploit for linux platform in category web applications !/usr/bin/perl -w Webmin 1.920 Remote Root Exploit Copyright 2019 c Todor Donev Disclaimer: This or previous programs are for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially the fact that...

openSUSE: Security Advisory for zypper, libzypp and libsolv (openSUSE-SU-2019:1927-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for zypper, libzypp and libsolv (moderate)

openSUSE Security Update: Security update for zypper, libzypp and libsolv Announcement ID: openSUSE-SU-2019:1927-1 Rating: moderate References: 1047962 1049826 1053177 1065022 1099019 1102261 1110542 1111319 1112911 1113296 1114908 1115341 1116840 1118758 1119373 1119820 1119873 1120263 1120463...

Nextcloud: Message Authentication Codes calculated by the Default Encryption Module allow an attacker to silently overwrite blocks in a file

First: The default encryption module bundled with the Nextcloud Server creates SHA256-HMAC based message authentication codes for each individual 6072 byte-sized block of data. These are the steps to calculate the MAC: Take the user password and harden it with SHA256-PBKDF2 denoted as $passPhrase...

Cross-Site Request Forgery Vulnerability in Multiple AudioCodes Products

AudioCodes Mediant 500L-MSBR and so on are products of AudioCodes Israel.AudioCodes Mediant 500L-MSBR is a 500L series all-in-one SOHO/SMB router.AudioCodes Mediant 500-MSBR is a 500 The AudioCodes Mediant 500-MSBR is a 500L series all-in-one SOHO/SMB router. A cross-site request forgery...

CVE-2019-9229

An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251. An internal interface exposed to the link-local address 169.254.254.253 allows attackers in the local network to access multiple quagga VTYs. Attackers...

CVE-2019-9228

An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A at least to 7.20A.252.062. The 1 management SSH and 2 management TELNET features allow remote attackers to cause a denial of service connection slot exhaustion via 5...

PT-2019-19451 · Audiocodes · Audiocodes Mediant 500L-Msbr +1

Name of the Vulnerable Software and Affected Versions: AudioCodes Mediant 500L-MSBR versions F7.20A through 7.20A.252.062 AudioCodes Mediant 500-MBSR versions F7.20A through 7.20A.252.062 AudioCodes Mediant M800B-MSBR versions F7.20A through 7.20A.252.062 AudioCodes Mediant 800C-MSBR versions...

U.S. Dept Of Defense: ██████████ bruteforceable RIC Codes allowing information on contracts

Summary: I'm entirely sure if this is anything useful from an attacker's purpose. Close the report if its not sensitive or non impactful. I noticed the DoD Warning mentioned it's sensitive so I thought to report it regardless just incase I noticed ████████ has a functionality to let you look up R...

keepalived: Heap-based buffer overflow when parsing HTTP status codes allows for denial of service or possibly arbitrary code execution

Heap-based buffer overflow vulnerability in extractstatuscode function in lib/html.c that parses HTTP status code returned from web server allows malicious web server or man-in-the-middle attacker pretending to be a web server to cause either a denial of service or potentially execute arbitrary...

Privilege Bypass Vulnerability in Schneider Electric P3420 PLC Module

Schneider Electric Modicon M340 PLC is a programmable controller product of Schneider Electric France. A privilege bypass vulnerability exists in the Schneider Electric P3420 PLC module. An attacker can cause the PLC to start and stop by constructing PLC start-stop data messages using private...

CVE-2019-13352

WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. By knowing this static secret and the corresponding algorithm for calculating support PINs, an attacker can reset the ADMIN password and thus gain remote...