om.themilitaryjob.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-970279 Security Researcher 0xrocky Helped patch 1796 vulnerabilities Received 7 Coordinated Disclosure badges Received 5 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting om.themilitaryjob.com websit...

PT-2019-5222 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.3.1 Description: The issue is related to the wp kses bad protocol function in WordPress, which mishandles the HTML5 colon named entity. This allows attackers to bypass input sanitization. For example, the...

Recommended update for opera (important)

openSUSE Security Update: Recommended update for opera Announcement ID: openSUSE-SU-2019:2107-1 Rating: important References: Affected Products: openSUSE Leap 15.1:NonFree openSUSE Leap 15.0:NonFree An update that contains security fixes can now be installed. Description:This update for opera fix...

PT-2019-4102 · None +4 · E2Fsprogs +4

Name of the Vulnerable Software and Affected Versions: E2fsprogs version 1.45.3 Description: The issue is related to a code execution vulnerability in the quota file functionality of E2fsprogs, which can be triggered by a specially crafted ext4 partition. This can cause an out-of-bounds write on...

PT-2019-14278 · Go · Gorm

Name of the Vulnerable Software and Affected Versions: GORM versions prior to 1.9.10 Description: The issue allows SQL injection via incomplete parentheses. It is noted that misusing GORM by passing untrusted user input where GORM expects trusted SQL fragments is a vulnerability in the applicatio...

openSUSE: Security Advisory for Recommended (openSUSE-SU-2019:1951-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for gpg2 (openSUSE-SU-2019:1917-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

PT-2019-13833 · Tribulant · Tribulant Newsletters

Name of the Vulnerable Software and Affected Versions: Tribulant Newsletters plugin versions prior to 4.6.19 Description: The issue allows directory traversal with resultant remote PHP code execution. This is achieved via the subscribers11 parameter in conjunction with an exportfile=../ value in...

PT-2019-9039 · Yandex · Clickhouse

Name of the Vulnerable Software and Affected Versions: ClickHouse versions prior to 1.1.54388 Description: The issue allows for Cross Protocol Request Forgery Attacks due to the "remote" table function permitting arbitrary symbols in the user, password, and default database fields. Recommendation...

PT-2019-10403 · WordPress · Wp Ultimate Csv Importer

Name of the Vulnerable Software and Affected Versions: wp-ultimate-csv-importer plugin versions prior to 5.6.1 Description: The issue concerns a CSRF problem in the wp-ultimate-csv-importer plugin for WordPress. Recommendations: For versions prior to 5.6.1, update to version 5.6.1 or later to...

PT-2019-7663 · WordPress · All-In-One-Wp-Security-And-Firewall

Name of the Vulnerable Software and Affected Versions: all-in-one-wp-security-and-firewall plugin versions prior to 4.0.6 Description: The issue concerns a cross-site scripting XSS problem in the settings pages of the plugin. Recommendations: For versions prior to 4.0.6, update to version 4.0.6 o...

PT-2019-12214

Name of the Vulnerable Software and Affected Versions Kubernetes versions prior to 1.15.0 Kubernetes versions prior to 1.14.4 Kubernetes versions prior to 1.13.8 Kubernetes versions prior to 1.12.10 Description The issue concerns the exposure of the debugging endpoint "/debug/pprof" over the...

PT-2021-7396 · FFmpeg +5 · Ffmpeg +5

Name of the Vulnerable Software and Affected Versions: FFmpeg version git commit de8e6e67e7523e48bb27ac224a0b446df05e1640 Description: The issue is related to an assertion failure at src/libavutil/mathematics.c in the FFmpeg library. This can be exploited by a remote attacker to cause a denial of...

PT-2019-14488

Name of the Vulnerable Software and Affected Versions Bitcoin Core version 0.18.0 Description The issue concerns the storage of wallet.dat data in memory by bitcoin-qt. When the program crashes, it may create a core file that contains unencrypted wallet data. If this core file is not handled...

PT-2019-11757 · Jenkins · Jenkins Maven Release Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Maven Release Plugin versions 0.14.0 and earlier Description: The issue concerns the storage of credentials in an unencrypted manner on the Jenkins master, allowing users with access to the master file system to view them. Specificall...

PT-2019-11759 · Jenkins · Jenkins Configuration As Code Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Configuration as Code Plugin versions 1.24 and earlier Description: The issue concerns the Jenkins Configuration as Code Plugin, which did not reliably identify sensitive values expected to be exported in their encrypted form...

NREL EnergyPlus

1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Low skill level to exploit Vendor: National Renewable Energy Laboratory NREL Equipment: EnergyPlus Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary...

PT-2019-13530 · Nevma · Nevma Adaptive Images

Name of the Vulnerable Software and Affected Versions: Nevma Adaptive Images plugin versions prior to 0.6.67 Description: The issue allows remote attackers to delete arbitrary files via the adaptive-images-settings parameter in adaptive-images-script.php. This is achieved by exploiting the...

PT-2019-13462 · Firefly Iii · Firefly-Iii

Name of the Vulnerable Software and Affected Versions: Firefly III versions prior to 4.7.17.3 Description: The issue is related to stored XSS due to the lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file id$ attachment...

PT-2019-16512 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: Oracle MySQL versions 8.0.16 and prior Description: The issue allows a low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks can result in unauthorized ability to cause a hang or...