OrientDB 3.0.17 GA Community Edition - Cross-Site Request Forgery / Cross-Site Scripting

Exploit Title: OrientDB 3.0.17 GA Community Edition March 7th, 2019 | Multiple Vulnerabilities Date: 07.03.2019 Exploit Author: Ozer Goker Vendor Homepage: https://orientdb.org Software Link: https://orientdb.org/download Version: 3.0.17 GA Community Edition March 7th, 2019 Introduction OrientDB ...

OrientDB 3.0.17 GA Community Edition XSS / CSRF

Exploit Title: OrientDB 3.0.17 GA Community Edition March 7th, 2019 | Multiple Vulnerabilities Date: 07.03.2019 Exploit Author: Ozer Goker Vendor Homepage: https://orientdb.org Software Link: https://orientdb.org/download Version: 3.0.17 GA Community Edition March 7th, 2019 Introduction OrientDB ...

[SECURITY] Fedora 29 Update: jackson-module-jsonSchema-2.9.8-1.fc29

Add-on module for to support JSON Schema version 3 generation...

Vulnerability of the Server component: The information schema of the MySQL database management system, which allows a hacker to cause a service failure.

The vulnerability of the Server component: The information schema of the Oracle MySQL database management system is related to insufficient access control. Exploiting this vulnerability may allow a malicious actor to cause service interruptions...

azureml-webservice-schema (>=0.1.57 <=1.0.33), gnuper (=0.0.3) +4 more potentially affected by CVE-2018-11760 via pyspark (>=2.3.0 <=2.3.1)

pyspark PYPI version =2.3.0, =0.1.57, =2.0.3, =0.2.0, =0.2.4 Source cves: CVE-2018-11760 Source advisory: OSV:GHSA-FVXV-9XXR-H7WJ...

azureml-webservice-schema (>=0.1.57 <=1.0.33), gnuper (=0.0.3) +4 more potentially affected by CVE-2018-11760 via pyspark (>=2.3.0 <=2.3.1)

pyspark PYPI version =2.3.0, =0.1.57, =2.0.3, =0.2.0, =0.2.4 Source cves: CVE-2018-11760 Source advisory: OSV:PYSEC-2019-169...

Joomla J-BusinessDirectory 4.9.7 Component - type SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component J-BusinessDirectory 4.9.7 - SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: http://cmsjunkie.com/ Software Link:...

Cross-site Scripting (XSS)

spacewalk-schema is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as a cross-site scripting XSS flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attack...

Modern POS 1.3 - SQL Injection

Exploit Title: Modern POS 1.3 - SQL Injection Dork: N/A Date: 2019-01-13 Exploit Author: Ihsan Sencan Vendor Homepage: http://itsolution24.com/ Software Link: https://codecanyon.net/item/modern-pos-point-of-sale-with-stock-management-system/22702683 Version: 1.3 Category: Webapps Tested on:...

biobb-io (>=0.0.1 <=0.0.8), biobb-model (>=0.0.1 <=0.0.10) +6 more potentially affected by CVE-2017-16876 via mistune (>=0.7.3 <=0.7.4)

mistune PYPI version =0.7.3, =0.0.1, =0.0.1, =0.0.6, =0.2.1, =2.2.20170208112505, =0.1.0, =0.1.2, =0.3.2 Source cves: CVE-2017-16876 Source advisory: OSV:GHSA-98GJ-WWXM-CJ3H...

[SECURITY] Fedora 29 Update: python-lxml-4.2.5-1.fc29

lxml is a Pythonic, mature binding for the libxml2 and libxslt libraries. It provides safe and convenient access to these libraries using the ElementTre e It extends the ElementTree API significantly to offer support for XPath, Relax NG, XML Schema, XSLT, C14N and much more.To contact the project...

CouchDB: Multiple vulnerabilities

Background Apache CouchDB is a distributed, fault-tolerant and schema-free document-oriented database. Description Multiple vulnerabilities have been discovered in CouchDB. Please review the CVE identifiers referenced below for details. Impact A remote attacker could execute arbitrary code or...

Microsoft SharePoint Server Information Disclosure Vulnerability

Microsoft SharePoint Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. An information...

WordPress Shopp 1.4 Database Disclosure

Exploit Title : WordPress Shopp Plugins 1.4 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 06/12/2018 Vendor Homepage : shopplugin.net wordpress.org/plugins/shopp/ Software Download Link : downloads.wordpress.org/plugin/shopp.zip Tested...

Moderate: Red Hat Security Advisory: rh-mysql57-mysql security update

An update for rh-mysql57-mysql is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

mysql: Server: Performance Schema unspecified vulnerability (CPU Apr 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Performance Schema. Supported versions that are affected are 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

Improper Access Control

derby is vulnerable to improper access control attacks. The vulnerability exists due to the lack of validation on privileges, allowing unauthorized users to drop schema in SQL authorization mode...

TIBCO MessagiTIBCO Messaging - Apache Kafka Distribution - Schema Repository Cross-Site Request Forgery Vulnerability

TIBCO Messaging - Apache Kafka Distribution - Schema Repository is a suite of application development and deployment solutions from TIBCO Software. A cross-site request forgery vulnerability exists in the Schema repository server component in TIBCO Messaging - Apache Kafka Distribution - Schema...

PostgreSQL -- SQL injection in pg_upgrade and pg_dump

The PostgreSQL project reports: CVE-2018-16850: SQL injection in pgupgrade and pgdump, via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can run arbitrary SQL statements with superuser privileges when a superuser runs pgupgrade on the database or during a...

CVE-2018-12413

The CVE-2018-12413 entry documents a CSRF vulnerability in the Schema repository server (tibschemad) of TIBCO Messaging - Apache Kafka Distribution. Affected are Community Edition 1.0.0 and Enterprise Edition 1.0.0. Underlying issue allows an attacker to perform CSRF attacks, potentially enabling...