Directory Traversal

Overview bikeshed is a pre-processor for spec documents. Affected versions of this package are vulnerable to Directory Traversal. This can occur when an untrusted source file containing include, include-code or include-raw block is processed. The contents of arbitrary files could be disclosed in...

5 Themes for Product Security and Fostering Organizational Growth

In this article we would like to review what Raj Umadas, Product Security Manager at Compass, has shared during our recent webinar highlighting recurring themes that have led to impactful collaborations and organizational risk reduction. Product security ProdSec is crucial in the process of growi...

CVE-2021-37557: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in image generation in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated but low-privileged attackers to execute arbitrary SQL commands via the include/views/graphs/generateGraphs/generateImage.php index parameter...

CVE-2021-24430

The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its cachingexcludeurls and cachingincludequerystrings settings before outputting them in a PHP file, which could lead to RCE...

PT-2021-15960

Name of the Vulnerable Software and Affected Versions Speed Booster Pack PageSpeed Optimization Suite WordPress plugin versions prior to 4.2.0 Description The issue arises from the plugin not validating its caching exclude urls and caching include query strings settings before outputting them in ...

Landray EKP cross-site scripting vulnerability

Landray EKP is an office automation solution that enables companies to easily model and manage... A cross-site scripting vulnerability in the /sys/attachment/uploaderServlet component of Landray EKP V12.0.9.R.20160325 could allow an attacker to execute arbitrary web script or HTML via a crafted...

CVE-2021-24453

The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution RCE of the system due to log poisoning and therefore potentially a full compromise of the underlying structure...

CVE-2021-24453

The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution RCE of the system due to log poisoning and therefore potentially a full compromise of the underlying structure...

Path traversal

The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution RCE of the system due to log poisoning and therefore potentially a full compromise of the underlying structure...

CVE-2021-24453 Include Me <= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoning

The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution RCE of the system due to log poisoning and therefore potentially a full compromise of the underlying structure...

PT-2021-15979

Name of the Vulnerable Software and Affected Versions Include Me WordPress plugin versions 1.2.1 and earlier Description The issue allows for path traversal and local file inclusion, potentially leading to Remote Code Execution RCE of the system due to log poisoning. This could result in a full...

CVE-2021-24453: Improper Limitation of a Pathname to a Restricted Directory

The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution RCE of the system due to log poisoning and therefore potentially a full compromise of the underlying structure...

WordPress path traversal vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A path traversal vulnerability exists in the WordPress plugin Include Me, which stems from the...

CVE-2020-22609

Cross Site Scripting XSS vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php...

CVE-2020-22608

Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php...

PT-2021-10772

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.12.6 Description The issue is related to a Cross Site Scripting XSS vulnerability. It affects the queue-name parameter in the include/class.queue.php file. There is no information provided about the estimated numbe...

PT-2021-10771

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.12.6 Description The issue is related to a Cross Site Scripting vulnerability. It can be exploited via the queue-name parameter to the "/include/ajax.search.php" API endpoint. Recommendations For versions prior to...

CVE-2020-22608: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php...

CVE-2020-22609: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php...

Enhancesoft osTicket cross-site scripting vulnerability

osTicket is a widely used and trusted open source work order support ticket system. A cross-site scripting vulnerability exists in osTicket versions prior to 1.12.6. An attacker can exploit this vulnerability via the queue-name parameter in include/class.queue.php...