4275 matches found
CVE-2019-15820
The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmisavesettings authentication...
CVE-2019-15820
The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmisavesettings authentication...
CVE-2019-15820: URL Redirection to Untrusted Site
The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmisavesettings authentication...
PT-2019-14409
Name of the Vulnerable Software and Affected Versions login-or-logout-menu-item plugin versions prior to 1.2.0 Description The issue concerns a lack of authentication requirement for lolmi save settings, potentially allowing unauthorized access. Recommendations For versions prior to 1.2.0, update...
CVE-2019-15779
The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qliggdismissnotice or qliggformitemdelete...
PT-2019-14388
Name of the Vulnerable Software and Affected Versions insta-gallery plugin versions prior to 2.4.8 Description The issue concerns the lack of nonce validation for certain actions. Specifically, it affects the qligg dismiss notice and qligg form item delete actions, which can be exploited due to t...
CVE-2019-10051
An issue was discovered in Suricata 4.1.3. If the function filetrackernewchunk encounters an unsafe "Somesfcm = ft.newchunk " item, then the program enters an smb/files.rs error condition and crashes...
CVE-2019-15480
Domoticz 4.10717 has XSS via item.Name...
CVE-2016-10895
The option-tree plugin before 2.6.0 for WordPress has XSS via an addlistitem or addsociallinks AJAX request...
PT-2019-7691
Name of the Vulnerable Software and Affected Versions option-tree plugin versions prior to 2.6.0 Description The issue allows for XSS via an add list item or add social links AJAX request. Recommendations For option-tree plugin versions prior to 2.6.0, update to version 2.6.0 or later to resolve...
CVE-2017-18482
cPanel before 62.0.4 allows resellers to use the WHM enqueuetransferitem API for queueing non-rearrange modules SEC-213...
PT-2019-8417
Name of the Vulnerable Software and Affected Versions cPanel versions prior to 62.0.4 Description The issue allows resellers to use the WHM "enqueue transfer item" API for queueing non-rearrange modules. Recommendations For versions prior to 62.0.4, update to version 62.0.4 or later to resolve th...
PT-2019-18790
Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description A cross-site request forgery CSRF issue exists in the checkout cart item. This could be exploited during editing or...
CVE-2019-7865: Cross-Site Request Forgery (CSRF)
A cross-site request forgery CSRF vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited at the time of editing or configuration...
Improper neutralization of item names in projects feature (NC-SA-2020-009)
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...
Synology Moments Path Traversal Vulnerability
Synology Moments is an image and video categorization management application from Synology, a Taiwan-based company. The program is able to recognize people, subjects and locations in photos and automatically categorize them through image recognition technology. A path traversal vulnerability exis...
CVE-2019-11826
Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users to upload arbitrary files via the name parameter...
Menu Item Extras - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2019-050
This module enables you to handle fields for Custom Menu Links. The module doesn't sufficiently check requests to one of the module controllers if the user has permission 'administer menu'. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create...
CVE-2019-5935
Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to change user information without access privileges via the Item function of User Information...