3140 matches found
CVE-2019-19134
The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of ...
CVE-2019-19134
The CVE-2019-19134 entry concerns WordPress Hero Maps Premium plugin (versions ≤ 2.2.1) with an unauthenticated XSS via views/dashboard/index.php p parameter. The issue arises from insufficient input sanitization, enabling injection of HTML/JavaScript in a user’s browser and potentially cookie th...
Hero Maps Premium < 2.2.3 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The hmapsprem WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability...
WordPress Hero Maps Premium plugin <= 2.2.1 - Unauthenticated Cross-Site Scripting (XSS) vulnerability
Unauthenticated Cross-Site Scripting XSS vulnerability discovered by Hooper Labs in WordPress Hero Maps Premium plugin versions = 2.2.1. Solution Update the WordPress Hero Maps Premium plugin to the latest available version at least 2.2.3...
WordPress Ultimate Membership Pro premium plugin <= 8.6.1 - Multiple Cross-Site Scripting (CSRF) vulnerabilities
Multiple Cross-Site Scripting CSRF vulnerabilities discovered ErwanLR in WordPress Ultimate Membership Pro premium plugin versions = 8.6.1. Solution Update the WordPress Ultimate Membership Pro premium plugin to the latest available version at least 8.6.2...
New 'Haken' Malware Found On Eight Apps In Google Play Store
Researchers have identified eight malicious Android apps in the official Google Play marketplace distributing a new malware family. The “Haken” malware exfiltrates sensitive data from victims and covertly signs them up for expensive premium subscription services. The eight apps in question, which...
Design/Logic Flaw
ESET Archive Support Module before 1296 allows virus-detection bypass via a crafted Compression Information Field in a ZIP archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro macOS, Cyber Security macOS, Mobile Security for...
CVE-2020-9264
The CVE refers to a vulnerability in the ESET Archive Support Module present in versions before 1296, which allows a virus-detection bypass via a crafted Compression Information Field in ZIP archives. Affected products include Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Secu...
CVE-2020-9264
ESET Archive Support Module before 1296 allows virus-detection bypass via a crafted Compression Information Field in a ZIP archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro macOS, Cyber Security macOS, Mobile Security for...
WordPress Ozeum premium theme <= 1.0.1 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by WordFence in WordPress Ozeum premium theme versions = 1.0.1. Solution Update the WordPress Ozeum premium theme to the latest available version at least 1.0.2...
WordPress Yottis premium theme <= 1.0 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by WordFence in WordPress Yottis premium theme versions = 1.0. Solution Update the WordPress Yottis premium theme to the latest available version at least 1.0.1...
WordPress Chit Club premium theme <= 1.0 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by WordFence in WordPress Chit Club premium theme versions = 1.0. Solution Update the WordPress Chit Club premium theme to the latest available version at least 1.0.1...
premium-speakers.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1093763 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Multiple Trend Micro products vulnerable to denial-of-service (DoS)
Overview Premium Security 2019 for Windows, Maximum Security 2019 for Windows, Internet Security 2019 for Windows, and Antivirus+ Security 2019 for Windows provided by Trend Micro Incorporated contain a denial-of-service DoS vulnerability CWE-400. BlackWingCat of Pink Flying Whale reported this...
JVN#02921757: Multiple Trend Micro products vulnerable to denial-of-service (DoS)
Premium Security 2019 for Windows, Maximum Security 2019 for Windows, Internet Security 2019 for Windows, and Antivirus+ Security 2019 for Windows provided by Trend Micro Incorporated contain a denial-of-service DoS vulnerability CWE-400. Impact An attacker may disable Premium Security 2019 for...
WordPress CarSpot premium theme <= 2.2.2 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability (ad post)
Authenticated Persistent Cross-Site Scripting XSS vulnerability ad post vulnerability discovered by m0ze in WordPress CarSpot premium theme versions = 2.2.2. Solution Update the WordPress CarSpot premium theme to the latest available version at least 2.2.3...
WordPress CarSpot premium theme <= 2.2.2 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability (registration form & user profile)
Authenticated Persistent Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress CarSpot premium theme versions = 2.2.2. Solution Update the WordPress CarSpot premium theme to the latest available version at least 2.2.3...
Trend Micro Maximum Security 2019 - Privilege Escalation
Trend Micro Maximum Security 2019 - Privilege Escalation Exploit Title: Trend Micro Maximum Security 2019 - Privilege Escalation Date: 2020-1-16 Exploit Author: hyp3rlinx Vendor Homepage: www.trendmicro.com Version: Platform Microsoft Windows, Premium Security 2019 v15, Maximum Security 2019 v15...
Schneider Electric Modicon Controllers (Update A)
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium Vulnerability: Improper Check for Unusual or Exceptional Conditions 2. UPDATE INFORMATION This updated...
WordPress ListingPro premium theme <= 2.5.3 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability
Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress ListingPro premium theme versions = 2.5.3. Solution Update the WordPress ListingPro premium theme to the latest available version at least 2.5.4...