Travel Management < 1.7 - Unauthenticated Options Change

The Travel Management WordPress plugin was affected by an Unauthenticated Options Change security vulnerability...

ND Donations < 1.4 - Unauthenticated Options Change

The Donations WordPress plugin was affected by an Unauthenticated Options Change security vulnerability...

CVE-2019-7940

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...

CVE-2019-5493

Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 are susceptible to a vulnerability which discloses information to an unauthenticated attacker. A successful attack requires that multiple non-default options be enabled...

Design/Logic Flaw

Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 are susceptible to a vulnerability which discloses information to an unauthenticated attacker. A successful attack requires that multiple non-default options be enabled...

CVE-2019-5493

Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 are susceptible to a vulnerability which discloses information to an unauthenticated attacker. A successful attack requires that multiple non-default options be enabled...

Wind River Systems VxWorks Parameter Denial of Service Vulnerability

Wind River Systems VxWorks is an embedded real-time operating system RTOS from Wind River Systems. A parameter injection vulnerability exists in Wind River Systems VxWorks. An attacker could exploit this vulnerability to cause a denial of service via malformed TCP options...

CVE-2019-10359

A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseActiondoSubmit method allowed attackers to perform releases with attacker-specified options...

Cross-Site Scripting (XSS)

web-console is vulnerable to cross-site scripting. The vulnerability, caused by missing X-Frame-Options and CSRF protections, in the oauth/token/request endpoint could allow a remote attacker to retrieve a token for CLI usage when using non default configs...

Wind River Systems VxWorks Buffer Overflow Vulnerability

Wind River Systems VxWorks is an embedded real-time operating system RTOS from Wind River Systems. A buffer overflow vulnerability exists in the parsing of IP options on IPv4 packets in Wind River Systems VxWorks versions 7 and 6.9. An attacker could use this vulnerability to cause the tNet0 task...

OSXCollector - A Forensic Evidence Collection & Analysis Toolkit For OS X

OSXCollector is a forensic evidence collection & analysis toolkit for OSX. Forensic Collection The collection script runs on a potentially infected machine and outputs a JSON file that describes the target machine. OSXCollector gathers information from plists, SQLite databases and the local file...

SUSE SLED12 / SLES12 Security Update : spamassassin (SUSE-SU-2019:1961-1)

This update for spamassassin to version 3.4.2 fixes the following issues : Security issues fixed : CVE-2017-15705: Fixed denial of service via unclosed tags in crafted emails bsc1108745. CVE-2018-11781: Fixed a code injection in the meta rule syntax by local users bsc1108748. CVE-2018-11780: Fixe...

web-console: XSS in OAuth server /oauth/token/request endpoint

A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction ...

CVE-2019-10968

Philips Holter 2010 Plus, all versions. A vulnerability has been identified that may allow system options that were not purchased to be enabled...

Code injection

Philips Holter 2010 Plus, all versions. A vulnerability has been identified that may allow system options that were not purchased to be enabled...

CVE-2019-10968

The CVE-2019-10968 vulnerability affects Philips Holter 2010 Plus (all versions). It concerns use of an obsolete function (CWE-477) that may allow enabling system options that were not purchased. The risk is described as local, with no remote exploitation and required high skill; impact is the po...

Shopify: Clickjacking in [exchangemarketplace.com]

Hi Team, Summary: X-Frame-Options ALLOW-FROM https://exchangemarketplace.com not supported by several Browser, this caused Clickjacking on https://exchangemarketplace.com Type of issue : Clickjacking Description: Clickjacking User Interface redress attack, UI redress attack, UI redressing is a...

WordPress Plugin Hybrid Composer 1.4.6 - Improper Access Restrictions

WordPress Plugin Hybrid Composer 1.4.6 - Improper Access Restrictions Exploit Title: Wordpress Hybrid Composer = 1.4.6 - Unauthenticated Configuration Access Admin Takeover Date: 2019-07-24 Vendor Homepage: http://wordpress.framework-y.com Software Link:...

WordPress Plugin Hybrid Composer 1.4.6 - Improper Access Restrictions

Exploit Title: Wordpress Hybrid Composer = 1.4.6 - Unauthenticated Configuration Access Admin Takeover Date: 2019-07-24 Vendor Homepage: http://wordpress.framework-y.com Software Link: http://wordpress.framework-y.com/hybrid-composer/ Reference:...

Cloud Foundry UAA Input Validation Error Vulnerability

Cloud Foundry UAA is an authentication and managed service endpoint for the CloudFoundry cloud platform from the Cloud Foundry Foundation in the United States. A security vulnerability exists in Cloud Foundry UAA versions prior to 73.4.0 that stems from the program not setting the X-FRAME-OPTIONS...