Catch Breadcrumb < 1.5.7 - Unauthenticated Reflected XSS

=== DESCRIPTION - REFLECTED XSS ======================================== Catch Breadcrumb 1.5.4 plugin for WordPress allow Reflected XSS via a search query when used with one of the theme from the same author: Alchemist & Alchemist PRO, Izabel & Izabel PRO, Chique & Chique PRO, Clean Enterprise &...

jizhi CMS 1.6.7 - Arbitrary File Download

Exploit Title: jizhi CMS 1.6.7 - Arbitrary File Download Google Dork: jizhicms Date: 2020-04-18 Exploit Author: iej1ctk1g Vendor Homepage: https://www.jizhicms.cn/ Software Link: http://down.jizhicms.cn/jizhicmsBeta1.6.7.zip Version: 1.6.7 Tested on： Mac OS CVE : N/A Data 1. POST...

Rank Math 0.9~1.0.42.1 - Missing Access Controls to Disable Competitor Plugins

Missing access controls on the GET requests to deactivate competitors' plugins. This could allow any authenticated users such as subscribers to deactivate the SEO and Sitemap plugins from competitors. The attack could also be performed via CSRF. PoC...

Rank Math 0.9~1.0.42.1 - Missing Access Controls to Disable Competitor Plugins

Missing access controls on the GET requests to deactivate competitors' plugins. This could allow any authenticated users such as subscribers to deactivate the SEO and Sitemap plugins from competitors. The attack could also be performed via CSRF...

Malicious Package

Overview delayedplugins-airbrake is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

[SECURITY] Fedora 31 Update: nrpe-4.0.2-2.fc31

Nrpe is a system daemon that will execute various Nagios plugins locally on behalf of a remote monitoring host that uses the checknrpe plugin. Various plugins that can be executed by the daemon are available at: http://sourceforge.net/projects/nagiosplug This package provides the core agent...

[SECURITY] Fedora 30 Update: nrpe-4.0.2-2.fc30

Nrpe is a system daemon that will execute various Nagios plugins locally on behalf of a remote monitoring host that uses the checknrpe plugin. Various plugins that can be executed by the daemon are available at: http://sourceforge.net/projects/nagiosplug This package provides the core agent...

container-tools:1.0 security update

An update is available for fuse-overlayfs, oci-umount, runc, skopeo, oci-systemd-hook, containernetworking-plugins. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE li...

OS Command Injection

apiconnect-cli-plugins is vulnerable to OS command injection. The vulnerability exists the values of pluginUri is not sanitized and can be controlled by users...

CVE-2020-7633

apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument...

CVE-2020-7633

apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument...

CVE-2020-7633

apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument...

Command injection

apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument...

CVE-2020-7633

apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument...

CVE-2020-7633

apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument...

CVE-2020-7633

CVE-2020-7633 affects the IBM API Connect plugin package apiconnect-cli-plugins up to version 6.0.1. The vulnerability is a Command Injection caused by lack of sanitization of the pluginUri parameter, enabling execution of arbitrary commands. Public references provide a PoC showing how an attacke...

[SECURITY] Fedora 32 Update: eclipse-pydev-7.5.0-1.fc32

The eclipse-pydev package contains Eclipse plugins for Python development...

CVE-2020-7633: Improper Neutralization of Special Elements used in an OS Command

apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument...

PT-2020-19669

Name of the Vulnerable Software and Affected Versions apiconnect-cli-plugins versions 6.0.1 and earlier Description The issue allows execution of arbitrary commands via the pluginUri argument, enabling command injection. This can be exploited by passing malicious input to the...

apic-apiconnect (>=1.1.0, <=1.1.1), apic-discount (1.0.0) +7 more potentially affected by CVE-2020-7633 via apiconnect-cli-plugins (>=1.1.1, <=8.0.1)

apiconnect-cli-plugins NPM version =1.1.1, =1.1.0, =1.0.1, =1.1.6, =1.0.0, =2.8.29, =1.0.5, =2.2.11 Source cves: CVE-2020-7633 Source advisory: SNYK:JS-APICONNECTCLIPLUGINS-564427...