8460 matches found
WordPress LifterLMS Plugin < 3.35.0 Unauthenticated Options Import Vulnerability
The WordPress plugin Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
Security update for git (moderate)
openSUSE Security Update: Security update for git Announcement ID: openSUSE-SU-2020:0598-1 Rating: moderate References: 1063412 1095218 1095219 1110949 1112230 1114225 1132350 1149792 1156651 1158785 1158787 1158788 1158789 1158790 1158791 1158792 1158793 1158795 1167890 1168930 1169605 1169786...
mailman -- arbitrary content injection vulnerability via options or private archive login pages
Mark Sapiro reports: A content injection vulnerability via the options login page has been discovered and reported by Vishal Singh. An issue similar to CVE-2018-13796 exists at different endpoint & param. It can lead to a phishing attack. added 2020-05-07 This is essentially the same as...
VulnCheck KEV: CVE-2019-17230
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes...
CVE-2019-11480
The pc-kernel snap build process hardcoded the --allow-insecure-repositories and --allow-unauthenticated apt options when creating the build chroot environment. This could allow an attacker who is able to perform a MITM attack between the build environment and the Ubuntu archive to install a...
Privilege Escalation
The Apache HTTP Server is vulnerable to Privilege Escalation. A flaw was found in the handling of the "Options" and "AllowOverride" directives. In configurations using the "AllowOverride" directive with certain "Options=" arguments, local users were not restricted from executing commands from a...
Remote Code Execution (RCE)
node-mpv is vulnerable to remote code execution RCE. The vulnerability exists because the parameter options was not sanitized properly, allowing to be controlled by the attacker by sending malicious code to execute...
WordPress OneTone theme unauthorized operation vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.OneTone theme is a responsive website theme plugin used in it. A security vulnerability exists in the includes/theme-functions.php file...
CVE-2020-7635
compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument...
CVE-2020-7632
node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...
CVE-2020-7635
compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument...
Command injection
node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...
CVE-2020-7635
compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument...
Remote Code Execution (RCE)
install-package is vulnerable to remote code execution RCE. The attack is possible due to lack of sanitization of options parameter, allowing an attack to take the control of it and execute malicious code...
UBUNTU-CVE-2020-11565
An issue was discovered in the Linux kernel through 5.6.2. mpolparsestr in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability...
The vulnerability of TCP protocols in real-time operating systems like Wind River VxWorks allows attackers to trigger service interruptions.
The vulnerability of the TCP protocol in real-time operating systems like Wind River VxWorks is related to errors in the creation of TCP options. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...
Command Injection
Overview compass-compile is a Compass wrapper for node.js. Affected versions of this package are vulnerable to Command Injection. The options argument can be controlled by users without any sanitization. PoC var Root = require'compass-compile'; var root = new Root; var options =...
Command Injection
Overview node-mpv is a wrapper to comfortably use mpv player with node.js. Affected versions of this package are vulnerable to Command Injection. The argument "options" can be controlled by users without any sanitization. PoC var Root = require"node-mpv"; var options = "binary": '" $touch JHU "'...
