2818 matches found
Poll Maker < 3.4.2 - Unauthenticated Time Based SQL Injection
The plugin allows unauthenticated users to perform SQL injection via the aysfinishpoll AJAX action. While the result is not disclosed in the response, it is possible to use a timing attack to exfiltrate data such as password hash. This requires a valid nonce, which can be obtained by going to a...
AZL-45225 CVE-2021-23440 affecting package js-jquery 3.5.0-4
This affects the package set-value before =3.0.0 4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays...
Oracle Enterprise Manager Ops Center (Oct 2020 CPU)
The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory. - A XML external entity injection XXE vulnerability in the Agent Provisioning Quartz Scheduler component of the Enterprise...
Oracle Linux 7 : bootstrap (ELSA-2021-9400)
The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-9400 advisory. 3.0.0-7.0.1 - Backport jQuery CVE-2020-11023 fixes from jQuery v3.5.0 to bundled v1.10.2 Orabug: 33181852 Tenable has extracted the preceding description block...
CVE-2021-34663
The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.5...
CVE-2021-34663
The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.5...
Cross site scripting
The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.5...
CVE-2021-34663
The CVE concerns the WordPress plugin jquery-tagline-rotator (affected up to version 0.1.5 ), which is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the file jquery-tagline-rotator.php . Exploitation could allow attackers to inject arbitrary web scripts. T...
CVE-2021-34663 jQuery Tagline Rotator <= 0.1.5 Reflected Cross-Site Scripting
The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.5...
PT-2021-20631
Name of the Vulnerable Software and Affected Versions: jQuery Tagline Rotator WordPress plugin versions up to and including 0.1.5 Description: The issue is related to Reflected Cross-Site Scripting, which allows attackers to inject arbitrary web scripts due to the use of $ SERVER'PHP SELF' in the...
CVE-2021-34663: Improper Neutralization of Input During Web Page Generation
The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.5...
jQuery Tagline Rotator <= 0.1.5 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts...
WordPress jQuery Tagline Rotator plugin <= 0.1.5 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by WordPress jQuery Tagline Rotator plugin versions = 0.1.5. Solution This plugin has been closed as of August 12, 2021 and is not available for download. This closure is temporary, pending a full review...
Cross-site Scripting (XSS)
Overview datatables.net is a DataTables for jQuery Affected versions of this package are vulnerable to Cross-site Scripting XSS. If an array is passed to the HTML escape entities function it would not have its contents escaped. PoC DataTables.net Name Name let test = "name" : "Hello World! " ,...
Multiple vulnerabilities in Extension "Miniorange Saml" (miniorange_saml)
The extension fails to properly encode user input for output in HTML context CVE-2021-36785. Also the extension contains sensitive data API credentials and private key which should not have been published CVE-2021-36786. Finally the extension bundles several 3rd Party Components jQuery and...
bootstrap security update
3.0.0-7.0.1 - Backport jQuery CVE-2020-11023 fixes from jQuery v3.5.0 to bundled v1.10.2 Orabug: 33181852...
Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2020-8908 DESCRIPTION: Guava could allow a remote authenticated attacker to bypass security restrictions, caused by a temp...
Security Bulletin: Multiple vulnerabilites affect IBM Jazz Foundation and IBM Engineering products.
Summary There are multiple vulnerabilities that are used by IBM Jazz Team Server affecting the following IBM Jazz Team Server based Applications: Engineering Lifecycle Management ELM, IBM Engineering Requirements Management DOORS Next DOORS Next, IBM Engineering Workflow Management EWM, IBM...
Security Bulletin: A cross-site scripting vulnerability in JQuery affects IBM InfoSphere Information Server
Summary A cross-site scripting vulnerability in JQuery used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID: CVE-2015-9251 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could explo...
