5594 matches found
CVE-2017-18604
The CVE-2017-18604 entry concerns the WordPress plugin sitebuilder-dynamic-components (up to version 1.0). Multiple sources confirm a PHP object injection vulnerability reachable via AJAX requests, enabling an unauthenticated/vector-based impact with HIGH integrity risk (CVSS v3.1: 7.5). Affected...
CVE-2017-18604
The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request...
PT-2019-8536
Name of the Vulnerable Software and Affected Versions gravitate-qa-tracker plugin versions 1.2.1 and earlier Description The issue concerns PHP Object Injection in the gravitate-qa-tracker plugin for WordPress. Recommendations For versions 1.2.1 and earlier, update to a version that fixes the PHP...
PT-2019-8535
Name of the Vulnerable Software and Affected Versions sitebuilder-dynamic-components plugin through 1.0 for WordPress Description The issue concerns PHP object injection via an AJAX request. This allows for potential exploitation. No information is provided about the estimated number of potential...
CVE-2017-18605: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection...
CVE-2017-18604: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request...
Debian DLA-1905-1 : gosa security update
GOsa² used unserialize to restore filter settings from a cookie. Since this cookie was supplied by the client, authenticated users could have passed arbitrary content to unserialized, which opened GOsa² up to a potential PHP object injection. For Debian 8 'Jessie', this problem has been...
Debian: Security Advisory (DLA-1905-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2019-13710
Name of the Vulnerable Software and Affected Versions GONICUS GOsa version 2.7.5.2 Description The issue allows a remote authenticated attacker to perform file deletions in the context of the user account that runs the web server. This is achieved via a crafted cookie value, specifically exploiti...
CVE-2019-15521
Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...
CVE-2019-15521
Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...
Code injection
Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...
CVE-2019-15521
Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...
CVE-2019-15521
CVE-2019-15521 affects Spoon Library up to 2014-02-06 as used in Fork CMS before 1.4.1 and other products. The vulnerability enables PHP object injection via a cookie containing a serialized object, allowing code execution under deserialization in spoon/cookie/cookie.php. Public sources (Red Hat,...
CVE-2019-15521
Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...
CVE-2019-15521: Deserialization of Untrusted Data
Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...
PT-2019-14243
Name of the Vulnerable Software and Affected Versions Spoon Library versions through 2014-02-06 Fork CMS versions prior to 1.4.1 Description The issue allows PHP object injection via a cookie containing an object. This can be exploited by manipulating the cookie to inject malicious PHP objects...
CVE-2018-20987
The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection...