PT-2019-12968

Name of the Vulnerable Software and Affected Versions 2by2host Widget Logic plugin versions prior to 5.10.2 Description A Cross-Site-Request-Forgery CSRF issue allows remote attackers to execute PHP code by crafting a malicious POST request that tricks administrators into adding the code. This is...

[SECURITY] Fedora 30 Update: drupal7-path_breadcrumbs-3.4-1.fc30

Path breadcrumbs module helps you to create breadcrumbs for any page with a ny selection rules and load any entity from the URL. Features Breadcrumbs navigation may be added to any kind of page: static example: node/1 or dynamic example: node/NID. You can load contexts from URL and use it like...

PT-2019-6165

Name of the Vulnerable Software and Affected Versions SphinxSearch in Sphinx Technologies Sphinx versions through 3.1.1 Description The issue is related to a directory traversal error in the search system, which can be exploited by a remote attacker to gain unauthorized access to protected...

GitLab CE/EE Information Disclosure Vulnerability (CNVD-2018-26954)

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing a project's file contents, commit history, bug lists, and more. An information disclosure...

Wolf CMS Cross-Site Scripting Vulnerability (CNVD-2018-15770)

Wolf CMS is a PHP-based open source content management system CMS developed by the Wolf CMS team. The system provides user interface , templates , user management and rights management and other functions . A cross-site scripting vulnerability exists in the Snippets tag in Wolf CMS version 0.8.3....

Code injection

Wolf CMS 0.8.3.1 has XSS in the Snippets tab, as demonstrated by a ?/admin/snippet/edit/1 URI...

CVE-2018-14837

Wolf CMS 0.8.3.1 has XSS in the Snippets tab, as demonstrated by a ?/admin/snippet/edit/1 URI...

CVE-2018-14837

Wolf CMS 0.8.3.1 has XSS in the Snippets tab, as demonstrated by a ?/admin/snippet/edit/1 URI...

CVE-2018-14837

Wolf CMS 0.8.3.1 has XSS in the Snippets tab, as demonstrated by a ?/admin/snippet/edit/1 URI...

CVE-2018-14837

CVE-2018-14837 — Wolf CMS 0.8.3.1 is confirmed to have a cross-site scripting (XSS) vulnerability in the Snippets tab, demonstrated via the /admin/snippet/edit/1 URI. The linked documents consistently describe the affected product and vest the issue as an XSS flaw; no explicit root-cause details,...

PT-2018-12755

Name of the Vulnerable Software and Affected Versions Wolf CMS version 0.8.3.1 Description The issue concerns a problem with the Snippets tab, where there is an XSS issue. This can be demonstrated by accessing the /admin/snippet/edit/1 API endpoint. Recommendations For Wolf CMS version 0.8.3.1,...

CVE-2018-14837: Improper Neutralization of Input During Web Page Generation

Wolf CMS 0.8.3.1 has XSS in the Snippets tab, as demonstrated by a ?/admin/snippet/edit/1 URI...

CVE-2016-10569

embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the...

CVE-2016-10569

embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the...

CVE-2016-10569

The CVE-2016-10569 issue affects the embedza module prior to version 1.2.4, where JavaScript resources are downloaded over HTTP. This enables a man-in-the-middle scenario where an attacker on the network could swap the requested JavaScript with a malicious file, potentially leading to remote code...

CVE-2016-10569

embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the...

GitLab: HTML TAG INJECTION ON PROFILE NAME

Allows me to change the profile name to an image tag and convert it into an html code and this tag appears perfectly on the "snippets" page. Suppose I include an image tag with source and when another user sees it on the "https://gitlab.com/snippets/1718284" page it will appear an image of an...

Fedora 27 : krb5 (2018-391a1f3e61)

Fix CVE-2018-5729, CVE-2018-5730. These are low-impact, requiring administrator access to exploit. ---- Fix leak in previous version. ---- Always read config snippets in alphabetical order per-directory. Note that Tenable Network Security has extracted the preceding description block directly fro...

All In One Schema.org Rich Snippets <= 1.4.4 - Authenticated Cross-Site Scripting (XSS)

The Schema – All In One Schema Rich Snippets WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability. PoC http://vulnerablesite.com/wp-admin/admin.php?page=richsnippetdashboardforcesend=truesendlabel=...

All In One Schema.org Rich Snippets <= 1.4.4 - Authenticated Cross-Site Scripting (XSS)

The Schema – All In One Schema Rich Snippets WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability. http://vulnerablesite.com/wp-admin/admin.php?page=richsnippetdashboard&bsfforcesend=true&bsfsendlabel=alert1...