10338 matches found
CVE-2015-9335
CVE-2015-9335 : A SQL injection vulnerability exists in the WordPress limit-attempts plugin prior to version 1.1.1 during IP address handling. This affects the plugin used with WordPress, enabling potentially unauthorized SQL commands through crafted input. The CVSS indications show high impact (...
CVE-2015-9335: Improper Neutralization of Special Elements used in an SQL Command
The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling...
PT-2019-7294
Name of the Vulnerable Software and Affected Versions WordPress limit-attempts plugin versions prior to 1.1.1 Description The issue concerns SQL injection during IP address handling. Recommendations For versions prior to 1.1.1, update to version 1.1.1 or later to resolve the issue...
PT-2019-17042 · Ibm · Ibm Security Guardium Big Data Intelligence
Name of the Vulnerable Software and Affected Versions: IBM Security Guardium Big Data Intelligence version 4.0 Description: The issue is related to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume...
curl security and bug fix update
7.29.0-54.0.1 - Security Fixes OraBug: 28939992 - CVE-2016-8615 cookie injection for other servers https://curl.haxx.se/docs/CVE-2016-8615.html - CVE-2016-8616 case insensitive password comparison https://curl.haxx.se/docs/CVE-2016-8616.html - CVE-2016-8617 OOB write via unchecked multiplication...
The vulnerability of the IcedTea-Web plugin, related to an incorrect limitation on the path name to the restricted access catalog, allows a hacker to write arbitrary files to the device’s file system.
The vulnerability of the IcedTea-Web plugin is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to write arbitrary files to the device’s file system using a specially crafted file in formats: .tar, .jar, .war,...
SUSE SLES12 Security Update : libvirt (SUSE-SU-2019:2105-1)
This update for libvirt fixes the following issues : Security issues fixed : CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd...
Scientific Linux Security Update : curl on SL7.x x86_64 (20190729)
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes : - curl: NTLM password overflow via integer overflow CVE-2018-14618 For more details about the security issues, including t...
Fedora 30 : proftpd (2019-e9187610c3)
This update addresses an arbitrary file copy vulnerability in modcopy in ProFTPD, which allowed for remote code execution and information disclosure without authentication due to not honoring constraints. Upstream bug: http://bugs.proftpd.org/showbug.cgi?id=4372 Note that Tenable Network Security...
CVE-2019-14796
The mq-woocommerce-products-price-bulk-edit aka Woocommerce Products Price Bulk Edit plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=updateoptions showproductspagelimit parameter...
GitLab: Uncontrolled Resource Consumption in any Markdown field using Mermaid
Summary I found a bypass for the mitigation of DoS via Mermaid CVE-2019-9220. As the mitigation for CVE-2019-9220, the input limit of 5000 characters is currently applied to a Mermaid code block, but it can be bypassed by simply splitting the longer payload to many code blocks. Steps to reproduce...
systemd: line splitting via fgets() allows for state injection during daemon-reexec
It was discovered that systemd is vulnerable to a state injection attack when deserializing the state of a service. Properties longer than LINEMAX are not correctly parsed and an attacker may abuse this flaw in particularly configured services to inject, change, or corrupt the service state...
edk2: Stack buffer overflow with corrupted BMP
A stack-based buffer overflow was discovered in edk2 when the HII database contains a Bitmap that claims to be 4-bit or 8-bit per pixel, but the palette contains more than 162^4 or 2562^8 colors...
The vulnerability of the mod_copy module in the ProFTPD FTP server allows a hacker to execute arbitrary code on the target system by sending CPFR and CPTO commands to the ProFTPD server.
The vulnerability of the modcopy module in the ProFTPD FTP server is related to errors during the checking of read and write access restrictions Limit READ and Limit WRITE. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the target system by sending commands CP...
CVE-2016-10857
cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit SEC-60...
Authentication flaw
cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit SEC-60...
CVE-2016-10857: Improper Access Control
cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit SEC-60...
PT-2019-7653
Name of the Vulnerable Software and Affected Versions cPanel versions prior to 11.54.0.0 Description The issue allows for a bypass of the e-mail sending limit. Recommendations For versions prior to 11.54.0.0, update to version 11.54.0.0 or later to resolve the issue...
curl, libcurl security update
CentOS Errata and Security Advisory CESA-2019:1880 An update for curl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...