WordPress magic-fields plugin cross-site scripting vulnerability (CNVD-2019-32383)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. magic-fields is a web form field customization plugin used in it. A cross-site scripting vulnerability exists in the WordPress...

WordPress magic-fields plugin cross-site scripting vulnerability (CNVD-2019-32372)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. magic-fields is a web form field customization plugin used in it. A cross-site scripting vulnerability exists in the WordPress...

CVE-2017-18609

The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter...

CVE-2017-18611

The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWPCreateCustomFieldPage.php custom-field-css parameter...

CVE-2017-18610

The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWPCreateCustomFieldPage.php custom-group-id parameter...

Design/Logic Flaw

The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter...

CVE-2017-18610

The CVE-2017-18610 issue affects the WordPress plugin “magic-fields” (before 1.7.2). The vulnerability is an XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter, as reported across multiple sources (Red Hat, CNVD, NVD mirrors, OSV, CVE lists). Impact described in sources is clie...

CVE-2017-18610

The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWPCreateCustomFieldPage.php custom-group-id parameter...

CVE-2017-18609

The CVE-2017-18609 entry concerns the WordPress plugin magic-fields, specifically versions before 1.7.2, which is vulnerable to cross-site scripting via the custom-write-panel-id parameter. Affected component: magic-fields plugin for WordPress. Root cause: XSS vulnerability in handling the custom...

CVE-2017-18610: Improper Neutralization of Input During Web Page Generation

The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWPCreateCustomFieldPage.php custom-group-id parameter...

CVE-2017-18611: Improper Neutralization of Input During Web Page Generation

The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWPCreateCustomFieldPage.php custom-field-css parameter...

PT-2019-8542

Name of the Vulnerable Software and Affected Versions magic-fields plugin versions prior to 1.7.2 Description The issue concerns a cross-site scripting XSS flaw. It is located in the RCCWP CreateCustomFieldPage.php file and is related to the custom-field-css parameter. This parameter is vulnerabl...

PT-2019-8541

Name of the Vulnerable Software and Affected Versions magic-fields plugin versions prior to 1.7.2 Description The issue concerns a Cross-Site Scripting XSS vulnerability. It affects the magic-fields plugin for WordPress, specifically through the custom-group-id parameter in the RCCWP...

PT-2019-8540

Name of the Vulnerable Software and Affected Versions magic-fields plugin versions prior to 1.7.2 Description The issue concerns a cross-site scripting XSS flaw. It is exploited via the custom-write-panel-id parameter. Recommendations For versions prior to 1.7.2, update to version 1.7.2 or later ...

CVE-2017-18609: Improper Neutralization of Input During Web Page Generation

The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter...

Remote Code Execution

spoon/library is vulnerable to remote code execution. Lack of validation of the cookie allows a remote attacker to submit a cookie containing malicious executable objects that will execute upon deserialization in the wakeup magic method in spoon/cookie/cookie.php...

Trend Micro Named A Leader in 2019 Gartner Magic Quadrant for Endpoint Protection Platforms

Leadership. It’s a weighty term, although frequently it is used too lightly and all too often it’s a self-declared position. We believe, leaders can come and go, and leadership can be fleeting depending on the factors for long term success. It is for all these reasons, that we are proud, not only...

NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0062)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has thunderbird packages installed that are affected by multiple vulnerabilities: - Incorrect convexity calculations in Skia in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform an out of bounds memory...

Apache Tika 1.15 - 1.17 - Header Command Injection Exploit

This Metasploit module exploits a command injection vulnerability in Apache Tika versions 1.15 through 1.17 on Windows. A file with the image/jp2 content-type is used to bypass magic byte checking. When OCR is specified in the request, parameters can be passed to change the parameters passed at...

PT-2019-7626

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 55.9999.141 Description The issue allows ACL bypass for AppConfig applications. This is achieved via the magic revision parameter. Recommendations For versions prior to 55.9999.141, update to version 55.9999.141 or lat...