fineartabstract.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-974583 Security Researcher devl00p Helped patch 3018 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting fineartabstract.com websi...

Command Injection in gitlabhook

All versions of gitlabhook are vulnerable to Command Injection. The package does not validate input the body of POST request and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. Recommendation No fix is currently available. Consider using an alternative...

CVE-2019-1235

An elevation of privilege vulnerability exists in Windows Text Service Framework TSF when the TSF server process does not validate the source of input or commands it receives, aka 'Windows Text Service Framework Elevation of Privilege Vulnerability'...

FreeType Buffer Overflow Vulnerability (CNVD-2019-30720)

FreeType is an open source font rendering library written in the C language. A buffer overflow vulnerability exists in the skipcomment file in psaux/psobjs.c in versions of FreeType prior to 2.6.1. The vulnerability stems from a networked system or product performing operations in memory without...

Local File Inclusion

larvitbase-www is vulnerable to local file inclusion. The package uses an exposed API endpoint that accepts an unvalidated GET parameter to a require function call. This could potentially allow a remote attacker to execute any .js files within the web server. Successful exploitation causes the...

Lute-Tab Buffer Overflow Vulnerability

Lute-Tab is a utility program for editing sound scores. A buffer overflow vulnerability exists in Lute-Tab. The vulnerability stems from a networked system or product performing operations in memory without properly validating data boundaries, resulting in incorrect read and write operations bein...

Gesior-AAC SQL Injection Vulnerability (CNVD-2019-31346)

Gesior-AAC is an official tibia.com layout created based on cipsoft. A SQL injection vulnerability exists in the thankyou.php file in versions of Gesior-AAC prior to 2019-05-01. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. ...

Ping Identity Agentless Integration Kit Cross-Site Scripting Vulnerability

Ping Identity Agentless Integration Kit is an agentless authentication development kit from Ping Identity. A cross-site scripting vulnerability exists in Ping Identity Agentless Integration Kit versions prior to 1.5. The vulnerability stems from the lack of proper validation of client-side data b...

Buffer overflow vulnerability in Linux kernel

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A buffer overflow vulnerability exists in the Linux kernel. The vulnerability arises from a networked system or product performing operations in memory without properl...

Local File Inclusion

larvitbase-api is vulnerable to local file inclusion. The package uses an exposed API endpoint that accepts an unvalidated GET parameter to a require function call. This could potentially allow a remote attacker to execute any .js files within the web server. Successful exploitation causes the...

WordPress email-newsletter SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. email-newsletter is an email newsletter plugin used in it. A SQL injection vulnerability exists in WordPress email-newsletter. The...

Remote Code Execution

spoon/library is vulnerable to remote code execution. Lack of validation of the cookie allows a remote attacker to submit a cookie containing malicious executable objects that will execute upon deserialization in the wakeup magic method in spoon/cookie/cookie.php...

Tasking Manager SQL Injection Vulnerability

Tasking Manager is a task management tool for coordinating volunteers and organizations from the OpenStreetMap team. A SQL injection vulnerability exists in Tasking Manager. The vulnerability stems from a lack of validation of externally entered SQL statements in the database-based application. A...

CVE-2019-15540

filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user...

WordPress wp-all-import plugin cross-site scripting vulnerability (CNVD-2019-28650)

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. wp-all-import is an XML, CSV file import plugin used in it. A cross-site scripting vulnerability exists in WordPress wp-all-import...

Intel Driver & Support Assistant elevation of privilege vulnerability (CNVD-2019-39683)

Intel Driver & Support Assistant is an Intel driver and support management tool from Intel Corporation USA. This tool is mainly used to get the latest applications provided by Intel. A security vulnerability exists in Intel Driver & Support Assistant versions prior to 19.7.30.2, which stems from...

classbook.sites.hubspot.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-951194 Security Researcher Gh05tPT Helped patch 6901 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting classbook.sites.hubspot.c...

CVE-2019-15150

In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function...

CVE-2019-1204

An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting of the messages. An attacker who successfully exploited the vulnerability could attempt to force Outlook to load a local or remote messag...

WordPress wp-ultimate-csv-importer plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. wp-ultimate-csv-importer plugin is used in which a CSV file import/export plugin. A cross-site scripting vulnerability...