Oracle Database Server Core RDBMS Component Input Validation Error Vulnerability

Oracle Database Server is a set of relational database management system of Oracle Oracle. The database management system provides data management, distributed processing and other functions.Core RDBMS is one of the relational database core components. An input validation error vulnerability exis...

UBUNTU-CVE-2018-14466

The Rx parser in tcpdump before 4.9.3 has a buffer over-read in print-rx.c:rxcachefind and rxcacheinsert...

WordPress insert-php plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress insert-php plugin versions prior to 2.2.8. The...

CVE-2019-16289

The insert-php aka Woody ad snippets plugin before 2.2.8 for WordPress allows authenticated XSS via the winpitem parameter...

Design/Logic Flaw

The insert-php aka Woody ad snippets plugin before 2.2.8 for WordPress allows authenticated XSS via the winpitem parameter...

CVE-2019-16289

The insert-php aka Woody ad snippets plugin before 2.2.8 for WordPress allows authenticated XSS via the winpitem parameter...

CVE-2019-16289

CVE-2019-16289 concerns the WordPress plugin insert-php (Woody ad snippets) , affected versions prior to 2.2.8. The vulnerability allows authenticated Cross-Site Scripting (XSS) through the winp_item parameter . Red Hat and CVE listings consistently describe the issue as an authenticated XSS flaw...

CVE-2019-15029

FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the serviceedit.php file which will insert the malicious command into the database. To trigger the command, one needs to call the services.php file via a GET request with the service id...

CVE-2017-18586

The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...

Directory traversal

The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...

CVE-2017-18586

The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...

CVE-2017-18586

CVE-2017-18586 affects the WordPress plugin Insert Pages (pre-3.2.4). The vulnerability is a directory-traversal flaw via custom template paths, allowing access to unintended files. Affected versions are prior to 3.2.4; remediation is to upgrade to 3.2.4 or later (plugin page: insert-pages). If e...

Denial Of Service (DoS)

mysql is vulnerable to denial of service. An easy to exploit vulnerability allows a high privileged attacker to crash the server, or perform unauthorized udpate, insert or delete...

Authorization Bypass

mysql is vulnerable to authorization bypass. An easily exploitable vulnerability allows a low privileged attacker to perform unauthorized update, insert or delete of data and cause a denial of service condition...

Authorization Bypass

mysql is vulnerable to authorization bypass. An easily exploitable vulnerability allows a high privileged attacker to perform unauthorized update, insert or delete...

CVE-2019-11198

Multiple cross-site scripting XSS vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 300583 - List Manager Dashboard module, 2 307638 - Campaign Creator module, 3 316994 - Attributes field, 4 I316995 - Icon Selection module, 5...

CVE-2019-11198

Multiple cross-site scripting XSS vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 300583 - List Manager Dashboard module, 2 307638 - Campaign Creator module, 3 316994 - Attributes field, 4 I316995 - Icon Selection module, 5...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 300583 - List Manager Dashboard module, 2 307638 - Campaign Creator module, 3 316994 - Attributes field, 4 I316995 - Icon Selection module, 5...

CVE-2019-11198

Multiple cross-site scripting XSS vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 300583 - List Manager Dashboard module, 2 307638 - Campaign Creator module, 3 316994 - Attributes field, 4 I316995 - Icon Selection module, 5...

Automattic: Stored Self XSS on https://app.crowdsignal.com (in Photo Insert App) + Stored XSS on https://*your-subdomain*.survey.fm

Steps: 1. Go to https://app.crowdsignal.com/dashboard and click Create a New Quiz 2. Add Multiple Choice to your page and click image button, upload a photo and click upload. 3. Start the burp suite and click Save button. Look at the request poc1.png and you will see mediacode= parameter. It will...