822 matches found
PT-2019-11730 · Jenkins · Jenkins Git Plugin
Name of the Vulnerable Software and Affected Versions: Jenkins Gitea Plugin versions 1.1.1 and earlier Description: The issue allows attackers without commit access to the Git repository to change Jenkinsfiles, even if Jenkins is configured to consider them untrusted. This is due to the lack of...
Dell EMC IsilonSD Management Server Cross-Site Scripting Vulnerability
Dell EMC IsilonSD Management Server is a management server for EMC IsilonSD storage from Dell USA. A cross-site scripting vulnerability exists in Dell EMC IsilonSD Management Server version 1.1.1, which stems from the failure of a WEB application to properly validate client-side data and can be...
GHSA-5GVM-HRW5-H6XF Improper Authentication in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authenticatio...
File Upload Vulnerability in Pole CMS v1.1.1
Pole CMS is an open source web content management system based on php5+mysql5 development. A file upload vulnerability exists in the Pole CMS ac.php page. An attacker can exploit the vulnerability to upload php files to gain server privileges...
CloudBees Jenkins JMS Messaging Plugin Server Request Forgery Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . JMS Messaging Plugin is used in one of the...
CVE-2019-0190
A bug exists in the way modssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause modssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or...
LayerBB Cross-Site Scripting Vulnerability
LayerBB is a small set of forum software. A cross-site scripting vulnerability exists in LayerBB version 1.1.1, which can be exploited by remote attackers to inject arbitrary Web script or HTML...
Security Bulletin: A Security Vulnerability has been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2018-1904)
Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin: Potenti...
Security Bulletin: A Security Vulnerability has been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2018-1926)
Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin: Potenti...
Information disclosure
Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained access to the Log Cache VM can read this secret, gaining all privileges held by the Log Cache UAA client. In the worst case, if this client is ...
WordPress Export Users to CSV Plugin CSV Injection Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Export Users to CSV plugin is used in one of the user data and other metadata exported to a CSV file plugin. A CSV...
CVE-2018-15571
The Export Users to CSV plugin through 1.1.1 for WordPress allows CSV injection...
YUNUCMS v1.1.1 D***.php page has SQL injection vulnerability
YUNUCMS enterprise website management system YUNUCMS is a set of professional marketing enterprise building system based on PHP + MYSQL as the core development. YUNUCMS v1.1.1 version of the D.php page SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive...
Code Execution Vulnerability in YUNUCMS v1.1.1
YUNUCMS enterprise website management system YUNUCMS is a set of professional marketing enterprise building system based on PHP + MYSQL as the core development. Code execution vulnerability exists in YUNUCMS v1.1.1. An attacker can exploit the vulnerability to execute arbitrary code and gain...
Microsoft ASP.NET Core Security Feature Bypass Vulnerability (Jul 2018)
This host is missing an important security update according to Microsoft advisory CVE-2018-8171. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...
Security Bulletin: Multiple security vulnerabilities has been identified in Websphere Application Server shipped with Tivoli Integrated Portal (CVE-2015-7450) (CVE-2015-2017)
Summary Embedded version of Websphere Application Server is shipped as a component of Tivoli Integrated Portal. Information about the security vulnerabilities affecting Embedded version of Websphere Application Server has been published in a security bulletin. Vulnerability Details Please consult...
Security Bulletin: Rational Insight - Oracle CPU October 2013 (CVE-2013-5802, CVE-2013-5825)
Summary Multiple security vulnerabilities exist in the IBM JRE that is shipped with Rational Insight. The same security vulnerabilities also exist in the IBM Java SDK that is shipped with the IBM WebSphere Application Server WAS. Vulnerability Details | Subscribe to My Notifications to be notifie...
CVE-2018-7422
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajaxpath parameter to editor/extensions/pagebuilder/includes/ajaxshortcodepattern.php, aka absolute path traversal...
CVE-2017-17322
Huawei Honor Smart Scale Application with software of 1.1.1 has an information disclosure vulnerability. The application does not sufficiently restrict the resource which can be accessed by certain protocol. An attacker could trick the user to click a malicious link, successful exploit could caus...