PT-2019-11469

Name of the Vulnerable Software and Affected Versions: TechyTalk Quick Chat WordPress Plugin affected versions not specified Description: The issue allows for SQL Injection, which can provide access to the database. The component like escape used in Quick-chat.php line 399 is involved. The attack...

CVE-2019-1010104: Improper Neutralization of Special Elements used in an SQL Command

TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection. The impact is: Access to the database. The component is: likeescape is used in Quick-chat.php line 399. The attack vector is: Crafted ajax request...

pharmapro.ch Cross Site Scripting vulnerability

Security Researcher metamorfosec Helped patch 1935 vulnerabilities Received 9 Coordinated Disclosure badges Received 31 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting pharmapro.ch website and its users. Following...

HPE Intelligent Management Center (IMC) quickTemplateSelect Expression Language Injection Remote Code Execution Vulnerability

HPE Intelligent Management Center IMC is a comprehensive management platform built from the ground up to support the Failure, Configuration, Accounting, Performance and Security FCAPS model. A quickTemplateSelect expression language injection remote code execution vulnerability exists in HPE...

Security Bulletin: IBM Security Guardium is affected by a Spring Framework vulnerability

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-15756 DESCRIPTION: Pivotal Spring Framework is vulnerable to a denial of service, caused by improper handling of range request by the ResourceHttpRequestHandler. By adding a range header...

Denial Of Service (DoS)

VNC display driver is vulnerable to denial of serviceDoS attacks. A user can exploit a flaw in the Quick Emulator QEMU component. The flaw could occur while refreshing the VNC display surface area in the 'vncrefreshserversurface' which leads to out-of-bounds memory access that may result in...

[SECURITY] Fedora 30 Update: bijiben-3.32.1-2.fc30

Simple note editor which emphasis on visuals : quickly write notes, quickly find it back...

macOS 10.13.x < 10.13.4 Multiple Vulnerabilities

Binary data 700515.prm...

Unable to attach from Citrix Files/Quick Edit into Secure Mail

Facing an issue where you open a number of different file types in Citrix Files/Quick Edit and select "Open In" and select "Copy to Secure Mail" and you receive a "Unable to attach file" error in Secure Mail...

Nested Pages <= 3.0.7 - Post Edit Bypass

Contributors could quick edit posts not authored by themselves, and could allow them to change the slugs as well as titles...

Gitlab -- Vulnerability

Gitlab reports: Project Runner Token Exposed Through Issues Quick Actions...

GitLab: JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions

The Quick Actions interpreter allows an attacker to reference a Project it does not have access to. The model attributes are then being serialized and returned to the user, which results in the Runner token both encrypted and unencrypted being returned to the user. This vulnerability is currently...

Simplifying Security Configuration: A UX Revamp Retrospective

With the March 2019 Release update, the Security Configuration User Interface UI evolution is now complete, and we hope it integrates more seamlessly into your online business. Over time, Akamai has added new products, features, and functionality to its security solutions to protect your web...

Ian Dunn: XSSI: Quick Navigation Interface - leak of private page/post titles

CVSS ---- Medium 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Description ----------- The Quick Navigation Interface plugin includes the names of all posts and pages in an automatically generated JavaScript file. By including this file in their own page, an attacker can view all post titles -...

Cross-Site Scripting (XSS)

modx/revolution is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via a document resource such as pagetitle through the update or quick edit action. The Javascript is executed when viewing manager logs...

CVE-2018-20756

MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...

Cross site scripting

MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...

CVE-2018-20756

MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...

CVE-2018-20756

MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...

CVE-2018-20756

MODX Revolution (through v2.7.0-pl) is affected by a cross-site scripting (XSS) vulnerability via a document resource (e.g., pagetitle) that is mishandled during Update or Quick Edit actions, or when viewing manager logs. The issue is documented across multiple sources (NVD and related advisories...