CVE-2019-14785

The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cpcontactformpaypal.php&pwizard=1 cpcontactformppid parameter...

CVE-2019-14785

The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cpcontactformpaypal.php&pwizard=1 cpcontactformppid parameter...

CVE-2019-14785: Improper Neutralization of Input During Web Page Generation

The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cpcontactformpaypal.php&pwizard=1 cpcontactformppid parameter...

PT-2019-13830

Name of the Vulnerable Software and Affected Versions CP Contact Form with PayPal plugin versions prior to 1.2.99 Description The issue concerns a Cross-Site Scripting XSS flaw in the publishing wizard of the plugin. This is accessible via the "wp-admin/admin.php?page=cp contact form...

Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal

CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N A third issue was discovered with the Kubernetes kubectl cp command that could enable a directory traversal such that a malicious container could replace or create files on a user’s workstation. The vulnerability is a client-side defect and requires us...

CVE-2019-1010112

OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery CSRF. The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3...

SQL Injection Vulnerability in the out-of-box cms cp***.asp File

Out of the ordinary cms website building system is usually used by industrial, communication, manufacturing and technology companies as a website building system, which is very widely used. SQL injection vulnerability exists in the cp.asp file, which can be exploited by attackers to obtain databa...

RHEL 7 : Red Hat OpenShift Container Platform 3.11 atomic-openshift (RHSA-2019:1633)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1633 advisory. Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private cloud...

kubernetes: Incomplete fix for CVE-2019-1002101 allows for arbitrary file write via `kubectl cp`

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is...

WordPress CP Contact Form with Paypal plugin <= 1.2.97 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found in WordPress CP Contact Form with Paypal plugin versions = 1.2.97. Solution Update the WordPress CP Contact Form with Paypal plugin to the latest available version at least 1.2.98...

Directory Traversal

github.com/kubernetes/kubernetes is vulnerable to directory traversal. The vulnerability exists in the untarAll function due to improper handling of symlinks which allows a remote attacker to replace files on a users workstation using kubectl cp command...

Siemens CP 1616 6GK1161-6AA02 Communications processor

Binary data 764359.prm...

Siemens CP 1604 6GK1160-4AA01 Communications processor

Binary data 764357.prm...

Siemens CP 1604 6GK1160-4AT01 Communications processor

Binary data 764358.prm...

Siemens CP 1604 and 1616 <= v2.8 Cross-Site Request Forgery

Binary data 720259.prm...

Siemens CP 1604 and 1616 <= v2.8 Improper Neutralization of Input during Web Page Generation

Binary data 720258.prm...

Siemens CP 1604 and 1616 <= v2.8 Cleartext Transmission of Sensitive Information

Binary data 720257.prm...

CVE-2018-15664

A flaw was discovered in the API endpoint behind the 'docker cp' command. The endpoint is vulnerable to a Time Of Check to Time Of Use TOCTOU vulnerability in the way it handles symbolic links inside a container. An attacker who has compromised an existing container can cause arbitrary files on t...

Siemens CP-443-1 Advanced Communications Adapter Detection

Binary data 763938.prm...

DEBIAN-CVE-2018-15664

In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operatio...