Oracle E-Business Suite CVE-2019-2990 Remote Security Vulnerability

Description Oracle E-Business Suite is prone to a remote security vulnerability in Oracle iStore. The vulnerability can be exploited over the 'HTTP' protocol. The 'Order Tracker' component is affected. This vulnerability affects the following supported versions: 12.1.1 through 12.1.3 and 12.2.3...

October 15, 2019-KB4519562 Cumulative Update for .NET Framework 4.8 for Windows 10 Version 1607 and Windows Server 2016

None None...

WordPress Core 5.2.3 - Viewing UnauthenticatedPasswordPrivate Posts

WordPress Core 5.2.3 - Viewing UnauthenticatedPasswordPrivate Posts So far we know that adding ?static=1 to a wordpress URL should leak its secret content Here are a few ways to manipulate the returned entries: - order with asc or desc - orderby - m with m=YYYY, m=YYYYMM or m=YYYYMMDD date format...

WordPress Core < 5.2.3 - Viewing Unauthenticated/Password/Private Posts

So far we know that adding ?static=1 to a wordpress URL should leak its secret content Here are a few ways to manipulate the returned entries: - order with asc or desc - orderby - m with m=YYYY, m=YYYYMM or m=YYYYMMDD date format In this case, simply reversing the order of the returned elements...

Adobe Suspends Accounts for All Venezuela Users Citing U.S. Sanctions

I have really bad news for Adobe customers in Venezuela… California-based software company Adobe on Monday announced to soon ban accounts and cancel the subscriptions for all of its customers in Venezuela in order to comply with economic sanctions that the United States imposed on the Latin...

Razer: [pay.gold.razer.com] Stored XSS - Order payment

The tester discovered that the pay.gold.razer.com site suffered from a Stored XSS issue that could be used to steal a client id and key. The tester worked with team to provide multiple POCs to help them resolve the issue. Razer appreciates all the assistance from corraldev, which was above and...

CVE-2019-17064

Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor...

WordPress Duplicate-Post 3.2.3 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Duplicate-Post 3.2.3 - Persistent Cross-Site Scripting Exploit Author: Unk9vvN Vendor Homepage: https://duplicate-post.lopo.it/ Software Link: https://wordpress.org/plugins/duplicate-post/ Version: 3.2.3 Tested on: Kali Linux CV...

CVE-2019-3646

DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection MTP Free Antivirus Trial 16.0.R18 and earlier allows local users to execute arbitrary code via execution from a compromised folder placed by an attacker with administrator rights...

Spoofing

DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection MTP Free Antivirus Trial 16.0.R18 and earlier allows local users to execute arbitrary code via execution from a compromised folder placed by an attacker with administrator rights...

CVE-2019-3646

CVE-2019-3646 affects Microsoft Windows client components of McAfee Total Protection (MTP) Free Antivirus Trial, up to and including version 16.0.R18. It is described as a DLL search order hijacking vulnerability that allows a local attacker with administrator rights to cause arbitrary code execu...

CVE-2019-3646 McAfee Total Protection - Free Antivirus Trial: DLL Search Order Hijacking vulnerability

DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection MTP Free Antivirus Trial 16.0.R18 and earlier allows local users to execute arbitrary code via execution from a compromised folder placed by an attacker with administrator rights...

CVE-2016-10940

The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter...

CVE-2016-10940

CVE-2016-10940 refers to the WordPress plug‑in zm-gallery 1.0, which is vulnerable to SQL injection through the order parameter. The Nuclei template and related sources describe the condition as a SQL injection that could allow an attacker to execute arbitrary SQL commands, potentially exposing o...

CVE-2017-18614

The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter...

CVE-2019-10074

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never...

CVE-2019-10074

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never...

CVE-2019-2175

In checkAccess of SliceManagerService.java in Android 9, there is a possible permissions check bypass due to incorrect order of arguments. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

WordPress Plugin Download Manager 2.9.93 - Cross-Site Scripting

WordPress Plugin Download Manager 2.9.93 - Cross-Site Scripting Exploit Title: WordPress Download Manager Cross-site Scripting Discovery Date: 2019-04-13 Exploit Author: ThuraMoeMyint Author Link: https://twitter.com/mgthuramoemyint Vendor Homepage: https://www.wpdownloadmanager.com Software Link...

CVE-2019-14979

cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the...