HackerOne: "Bounties paid in the last 90 days" discloses the undisclosed bounty amount in program statistics

Hi Team, Summary: I have found a bypass on this disclosed report: Know undisclosed Bounty Amount when Bounty Statistics are enabled. Description: When a program does not disclose how much bounty is paid to particular report, but if bounty statics is enabled then undisclosed Bounty Amount can be...

WordPress Visitor Traffic Real Time Statistics Plugin < 1.12 CSRF Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

WordPress Visitor Traffic Real Time Statistics Plugin < 1.13 CSRF Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

WordPress visitors-traffic-real-time-statistics plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. visitors-traffic-real-time-statistics is a real-time website traffic statistics plugin used in it. A cross-site request forgery...

WordPress visitors-traffic-real-time-statistics plugin cross-site request forgery vulnerability (CNVD-2019-30099)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. visitors-traffic-real-time-statistics is a real-time website traffic statistics plugin used in it. A cross-site request forgery...

CVE-2019-15831

The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page...

CVE-2019-15831

The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page...

CVE-2019-15832

The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF...

Cross site request forgery (csrf)

The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page...

CVE-2019-15832

Affected product: WordPress plugin visitors-traffic-real-time-statistics (pre-1.13). Vulnerability: CSRF in the plugin that can trigger unintended requests from authenticated users. Root cause/impact: described as CSRF with high potential impact on confidentiality, integrity, and availability (CV...

WordPress newstatpress plugin cross-site scripting vulnerability (CNVD-2019-30373)

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. newstatpress is a plugin used in it for real-time statistics on blog visits. A cross-site scripting vulnerability exists in the...

CVE-2017-18515

The wp-statistics plugin before 12.0.8 for WordPress has SQL injection...

CVE-2017-18515

The wp-statistics plugin before 12.0.8 for WordPress has SQL injection...

Sql injection

The wp-statistics plugin before 12.0.8 for WordPress has SQL injection...

CVE-2017-18515

The wp-statistics plugin before 12.0.8 for WordPress has SQL injection...

CVE-2017-18515

CVE-2017-18515 affects the WordPress WP Statistics plugin prior to version 12.0.8, exposing an SQL injection vulnerability in that plugin (VendorFix remediation). NVD, Red Hat and OpenVAS references document the issue with CVSS/impact details and indicate upgrading to 12.0.8+ as the fix.

Honeywell Experion C300 Controller

Binary data 764916.prm...

Honeywell Experion C300 Controller

Binary data 764917.prm...

CVE-2019-14669

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics page...

CVE-2019-14669

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics page...