SUSE-SU-2019:1806-1 Security update for libdlm, libqb

This update for libdlm, libqb fixes the following issues: libqb to version 1.0.3: - CVE-2019-12779: Fixed an insecure treatment of IPC temporary files which could have allowed a local attacker to overwrite privileged system files bsc1137835. - Enabled use of filesystem sockets for linux fate32341...

WordPress Custom CSS Pro plugin <= 1.0.3 - Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) vulnerabilities

Cross-Site Request Forgery CSRF and Cross-Site Scripting XSS vulnerabilities found by Cryptography Laboratory in WordPress Custom CSS Pro plugin versions = 1.0.3. Solution Update the WordPress Custom CSS Pro plugin to the latest available version at least 1.0.4...

CVE-2019-5984

Cross-site request forgery CSRF vulnerability in Custom CSS Pro 1.0.3 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

WordPress Custom CSS Pro plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Custom CSS Pro plugin is a CSS editor plugin used in it. A cross-site request forgery vulnerability exists in WordPress Custom CSS Pro...

PHP Scripts Mall Cab Booking Script Path Traversal Vulnerability

PHP Scripts Mall Cab Booking Script is a cab booking website system by PHP Scripts Mall India. A path traversal vulnerability exists in PHP Scripts Mall Cab Booking Script version 1.0.3, which can be exploited by an attacker to obtain a list of parent directories for jpg or png files...

UBUNTU-CVE-2018-1000875

Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code version 0.9-1.0.2 contains a CWE-302: Authentication Bypass by Assumed-Immutable Data vulnerability in Website Terms of Service Acceptance Page that can result in Access to any user account. This attack appear to be...

CVE-2018-1000875

Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code version 0.9-1.0.2 contains a CWE-302: Authentication Bypass by Assumed-Immutable Data vulnerability in Website Terms of Service Acceptance Page that can result in Access to any user account. This attack appear to be...

CVE-2018-1000846

FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery CSRF vulnerability in All authenticated API calls in index.php / class.manager.php that can result in Editing domains and zones with victim's privileges. This attack appear to be exploitable via Victim must open a website...

CVE-2018-1000847

FreshDNS version 1.0.3 and prior contains a Cross Site Scripting XSS vulnerability in Account data form; Zone editor that can result in Execution of attacker's JavaScript code in victim's session. This attack appear to be exploitable via The attacker stores a specially crafted string as their Ful...

GHSA-QC8J-M8J3-RJQ6 Moderate severity vulnerability that affects rails-html-sanitizer

Withdrawn, accidental duplicate publish. Cross-site scripting XSS vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes...

CyBroHttpServer Directory Traversal Vulnerability

Cybrotech CyBroHttpServer is a communication server for reading/writing CyBro variables by name from Cybrotech UK. A directory traversal vulnerability exists in Cybrotech CyBroHttpServer version 1.0.3. An attacker can leverage the URI '... /' in the URI to read sensitive information...

CVE-2018-16133

Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI...

Directory traversal

Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI...

Microsoft ASP.NET Core Security Feature Bypass Vulnerability (Jul 2018)

This host is missing an important security update according to Microsoft advisory CVE-2018-8171. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

CVE-2018-3747

The public node module versions = 1.0.3 allows to embed HTML in file names, which in certain conditions might lead to execute malicious JavaScript...

Malicious Package

Overview Version 1.0.3 of @impala/bmap contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.0.3 of this module is found installe...

UBUNTU-CVE-2017-2923

An exploitable heap based buffer overflow vulnerability exists in the 'readbiffnextrecord function' of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability...

SquadManagement,1.0.3,SQL Injection

SquadManagement by Lars Hildebrandt, versions 1.0.3 and previous, SQL Injection...

Legion of the Bouncy Castle TLS Information Disclosure Vulnerability

Legion of the Bouncy Castle is an open source, lightweight cipher package for the Java platform from Legion of the Bouncy Castle Australia.TLS is one of the secure transport layer protocols. An information disclosure vulnerability exists in Legion of the Bouncy Castle TLS versions prior to 1.0.3,...

Red Hat JBoss KeyCloak Cross-Site Request Forgery Vulnerability

Red Hat JBoss KeyCloak is the United States Red Hat Red Hat company's open source for modern applications and services in the authentication and access management software. A cross-site request forgery vulnerability exists in the org.keycloak.services.resources.SocialResource.callback method in R...