3429 matches found
PT-2018-5748
Name of the Vulnerable Software and Affected Versions: IBM UrbanCode Deploy versions 6.1 through 6.2 Description: The issue is related to improper access controls, allowing an authenticated user to edit objects they should not have access to. Recommendations: For versions 6.1 and 6.2, update to a...
CVE-2017-1000463
Leafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability, within the edit blog post page, which can result in disruption of service and execution of javascript code...
[SECURITY] Fedora 26 Update: evince-3.24.2-2.fc26
Evince is simple multi-page document viewer. It can display and print Portable Document Format PDF, PostScript PS and Encapsulated PostScript EPS files. When supported by the document format, evince allows searching for text, copying text to the clipboard, hypertext navigation, table-of-contents...
CVE-2017-17903
FS Lynda Clone has CSRF via user/editprofile, as demonstrated by adding content to the user panel...
OhMiBod Remote app for Android and iOS User Impersonation Vulnerability
OhMiBod Remote app for Android and iOS is a wireless remote control app for Android and iOS based platforms. A security vulnerability exists in the OhMiBod Remote app for Android and iOS based platforms. A remote attacker can exploit the vulnerability by sniffing network traffic and editing the...
WordPress Elementor Page Builder <=1.7.12 - Authenticated Unrestricted Editing vulnerability
Authenticated Unrestricted Editing vulnerability found by James Golovich in WordPress Elementor Page Builder version =1.7.12. Solution Update the WordPress Elementor Page Builder to the latest available version at least 1.8.0...
CVE-2017-14487
The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, userid, and token fields in data/data/com.ohmibod.remote2/sharedprefs/OMB.xml...
Buffer overflow
The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, userid, and token fields in data/data/com.ohmibod.remote2/sharedprefs/OMB.xml...
CVE-2017-14487
The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, userid, and token fields in data/data/com.ohmibod.remote2/sharedprefs/OMB.xml...
Atlassian Jira, Python and automated labeling
I have already wrote about Atlassian Jira automation in "Automated task processing with JIRA API". But all examples there were with using of curl. So, I decided to make one more post about Jira API. This time with python examples and about labeling issues nice wordplay, right? . You can use label...
Elementor Page Builder <= 1.7.12 - Authenticated Unrestricted Editing
Many AJAX actions are unsecured, allowing logged in users unrestricted access to the internal Elementor functions...
CVE-2017-16560
SanDisk Secure Access 3.01 vault decrypts and copies encrypted files to a temporary folder, where they can remain indefinitely in certain situations, such as if the file is being edited when the user exits the application or if the application crashes...
DEBIAN-CVE-2017-8814
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk."...
CVE-2017-1000156
Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable by any group member even when they didn't have the admin role...
CVE-2017-1000156
Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable by any group member even when they didn't have the admin role...
PT-2017-10856
Name of the Vulnerable Software and Affected Versions Mahara versions 15.04 through 15.04.8 Mahara versions 15.10 through 15.10.4 Mahara versions 16.04 through 16.04.2 Description The issue allows a group's configuration page to be edited by any group member, even if they do not have the admin...
CVE-2017-15982
Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/adminprocess.php for form editing...
CVE-2017-15982
Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/adminprocess.php for form editing...