WordPress User Submitted Posts plugin <= 20190426 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability found by NinTechNet in WordPress User Submitted Posts plugin versions = 20190426. Apache + PHP FastCGI required for exploitation of this vulnerability. Solution Update the WordPress User Submitted Posts plugin to the latest available version at least 20190501...

[SECURITY] Fedora 30 Update: drupal7-views-3.23-1.fc30

You need Views if: You like the default front page view, but you find you want to sort it differently. You like the default taxonomy/term view, but you find you want to sort it differently; for example, alphabetically. You use /tracker, but you want to restrict it to posts of a certain type. You...

ZOHO ManageEngine ServiceDesk Plus Permission License and Access Control Issues Vulnerability

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A vulnerability exis...

CVE-2019-12253

CVE-2019-12253 affects the project’s “my little forum” prior to version 2.4.20. The vulnerability is a CSRF flaw that allows deleting posts via a crafted request (e.g., mode=posting&delete_posting). The issue is confirmed across multiple feeds (NVD/NVD-derived entries, Red Hat advisory, OSV, CVE ...

CVE-2019-12253

my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&deleteposting...

PT-2019-12719 · Zoho · Zoho Manageengine Servicedesk Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus versions prior to 10.6 Description: The issue allows users with the lowest privileges, such as guest users, to view arbitrary posts by manipulating the URL. This can be achieved by appending the post number ...

CVE-2019-0708

creationtimestamp| type| source ---|---|--- 2019-05-14 05:00:00+00:00| seen| https://msrc.microsoft.com/blog/2019/05/prevent-a-worm-by-updating-remote-desktop-services-cve-2019-0708/ 2019-05-14 20:27:23+00:00| seen| https://t.me/thehackernews/305 2019-05-14 21:31:48+00:00| seen|...

XSS Vulnerability at JEESNS Group Posts

JEESNS is an open source social management system developed on the JAVA enterprise level platform. JEESNS group posts at the existence of XSS vulnerability , an attacker can be exploited to inject arbitrary Web script or HTML...

CVE-2019-11869

The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...

CVE-2019-11869

The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...

Design/Logic Flaw

The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...

CVE-2019-11869

The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...

CVE-2019-11869

The CVE-2019-11869 entry concerns the WordPress Yuzo Related Posts plugin before 5.12.94. A cross-site scripting (XSS) flaw arises because the plugin relies on is_admin() to verify the request origin, but that check only confirms the request targets an admin page, not that it comes from an admin ...

VulnCheck KEV: CVE-2019-11869

The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin...

Users Urged to Uninstall WordPress Yuzo Plugin After Flaw Exploited

UPDATE Users of the popular Yuzo Related Posts plugin are being urged to uninstall the plugin after a flaw was discovered being exploited in the wild – putting tens of thousands of websites at risk. Yuzo Related Posts, which enables WordPress websites to display “related posts” segments, is...

WordPress Yuzo Related Posts plugin <=5.12.91 - Broken authentication

Broken authentication and session management allows unauthenticated call any action or update any option on WordPress Yuzo Related Posts plugin versions =5.12.91. Solution 10 April 2019 - this plugin was closed and is no longer available for download...

Vanilla: Stored XSS in embedded posts containing images

Summary: Embedded posts containing images can be maliciously crafted to insert Javascript code to run on page load. Description: Steps to reproduce: 1. Ensure you are logged into an account no special permissions are needed 2. Navigate to any page with the richEditor component e.g. any forum post...

WordPress Delete Duplicate Posts plugin <= 4.1.9.4 - Authenticated Option Update vulnerability (Fremius Library security issue)

Authenticated Option Update vulnerability Fremius Library security issue in WordPress Delete Duplicate Posts plugin versions = 4.1.9.4. Solution Update the WordPress Delete Duplicate Posts plugin to the latest available version at least 4.1.9.5...

idreamsoft iCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-12121)

iCMS is an efficient and simple content management system built with PHP and MySQL. A cross-site request forgery vulnerability exists in idreamsoft iCMS 7.0.14 and earlier versions, which can be exploited by an attacker to delete a user's posts via public/api.php?app=user URI...

CVE-2019-8372

creationtimestamp| type| source ---|---|--- 2019-02-18 15:21:43+00:00| published-proof-of-concept| https://t.me/news4hack/279 2019-02-19 14:04:10+00:00| published-proof-of-concept| https://t.me/antichat/3674 2019-02-19 15:03:47+00:00| published-proof-of-concept| https://t.me/canyoupwnme/5138...