Open redirect

An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share application is vulnerable to an Open Redirect attack via a crafted POST request. By manipulating the POST parameters, an attacker can redirect a victim to a malicious website over any...

UBUNTU-CVE-2019-9854

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...

Ubuntu 19.04 : samba vulnerability (USN-4121-1)

Stefan Metzmacher discovered that the Samba SMB server did not properly prevent clients from escaping outside the share root directory in some situations. An attacker could use this to gain access to files outside of the Samba share, where allowed by the permissions of the underlying filesystem...

Samba Share Path Definition Escape Vulnerability (CVE-2019-10197)

Samba is prone to a share path definition escape vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:samba:samba";...

UBUNTU-CVE-2019-10197

A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directorie...

samba -- combination of parameters and permissions can allow user to escape from the share path definition

The samba project reports: On a Samba SMB server for all versions of Samba from 4.9.0 clients are able to escape outside the share root directory if certain configuration parameters set in the smb.conf file...

WordPress share-on-diaspora plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. share-on-diaspora is a plugin that adds share buttons to it. A cross-site scripting vulnerability exists in the WordPress...

File upload vulnerability in the shared human resources management system

Dongguan City, the same share software technology limited company is a focus on manufacturing, commercial circulation, government departments, enterprises and institutions, such as management software development and service company. There is a file upload vulnerability in the same share human...

CVE-2017-18534

The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters...

CVE-2017-18534

The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters...

Cross site scripting

The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters...

CVE-2017-18534

The CVE-2017-18534 entry concerns the WordPress plugin “share-on-diaspora” prior to version 0.7.2, which is affected by a reflected XSS in share URL parameters. Multiple connected sources (e.g., CVE records and vendor/tier aggregations) confirm the component (Share On Diaspora WordPress plugin) a...

CVE-2017-18534

The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters...

Nextcloud: Circle email-members have still access to a shared folder/file after they are removed from the circle

If a email-address is added to a circle, the email user has still access after the email-address is removed from the circle. Requirements ------- circles app and share by mail app enabled Steps to reproduce ------------- 1. add an email address to a circle 2. share a folder/file with the circle 3...

WordPress simple-share-buttons-adder plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. simple-share-buttons-adder plugin is used in one of the share buttons to add a plugin. A cross-site scripting vulnerability...

PT-2019-2923 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: A remote code execution issue exists in Microsoft Windows, related to the processing of .LNK files. If a malicious .LNK file is processed, an attacker could execute arbitrary code...

sssd security, bug fix, and enhancement update

1.16.4-21 - Resolves: rhbz1714952 - sssd RHEL 7.7 Tier 0 Localization - Rebuild japanese gmo file explicitly 1.16.4-20 - Resolves: rhbz1714952 - sssd RHEL 7.7 Tier 0 Localization 1.16.4-19 - Resolves: rhbz1707959 - sssd does not properly check GSS-SPNEGO 1.16.4-18 - Resolves: rhbz1710286 - The...

CVE-2015-9303

The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS...

CVE-2015-9303

CVE-2015-9303 affects the WordPress plugin Simple Share Buttons Adder, specifically versions prior to 6.0.0. Multiple connected sources describe a cross-site scripting (XSS) vulnerability in this plugin, with evidence of a reflected XSS class in public disclosures. The root cause is insufficient ...

samba: save registry file outside share as unprivileged user

A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share...