CVE-2019-11246

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is...

CVE-2019-11246

CVE-2019-11246 : Kubernetes kubectl cp uses tar inside the container to create an archive, which kubectl unpacks on the user’s machine. If the container tar is malicious, it could run code and write files to the local filesystem, limited by the user’s permissions. Affected Kubernetes versions inc...

WordPress cp-polls plugin cross-site scripting vulnerability (CNVD-2019-29239)

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress cp-polls plugin versions prior to 1.0.5. The vulnerability stems...

WordPress cp-polls plugin cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress cp-polls plugin versions prior to 1.0.1. The vulnerability stems...

Cross site scripting

The cp-polls plugin before 1.0.5 for WordPress has XSS...

Design/Logic Flaw

The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list...

CVE-2014-10395

The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list...

CVE-2014-10395

The CVE-2014-10395 issue affects the WordPress cp-polls plugin prior to version 1.0.1, introducing a cross-site scripting (XSS) vulnerability in the votes list. Root cause described in CNVD as insufficient validation of client-side data by the web application. Impact noted as potential execution ...

CVE-2015-9346

The cp-polls plugin before 1.0.5 for WordPress has XSS...

CVE-2015-9346

CVE-2015-9346 concerns the WordPress cp-polls plugin prior to version 1.0.5, where a cross-site scripting (XSS) vulnerability exists in the plugin’s handling of user-supplied input. The issue is described as an XSS flaw enabling an attacker to execute client-side code within the context of the af...

CVE-2019-14784

The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition...

CVE-2019-14784

The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition...

CVE-2019-14784

The CVE-2019-14784 entry applies to the WordPress plugin CP Contact Form with PayPal (pre-1.2.98). It contains an XSS in CSS edition vulnerability in the plugin’s admin/css handling, with PoC evidence showing input can be reflected in the admin interface. Affected versions are prior to 1.2.98; a ...

Siemens SIMATIC S7-300 CP 341 Communications processor

Binary data 764910.prm...

Siemens SIMATIC S7-300 CP 341 Communications processor

Binary data 764909.prm...

CVE-2019-14785

The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cpcontactformpaypal.php&pwizard=1 cpcontactformppid parameter...

CVE-2019-14785

The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cpcontactformpaypal.php&pwizard=1 cpcontactformppid parameter...

Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal

CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N A third issue was discovered with the Kubernetes kubectl cp command that could enable a directory traversal such that a malicious container could replace or create files on a user’s workstation. The vulnerability is a client-side defect and requires us...

CVE-2019-1010112

OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery CSRF. The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3...

SQL Injection Vulnerability in the out-of-box cms cp***.asp File

Out of the ordinary cms website building system is usually used by industrial, communication, manufacturing and technology companies as a website building system, which is very widely used. SQL injection vulnerability exists in the cp.asp file, which can be exploited by attackers to obtain databa...