Node-RED Path Traversal Vulnerability

Node-Red is an open source stream-based visual programming development tool for connecting hardware devices, APIs and online services together as part of the Internet of Things. A path traversal vulnerability exists in Node-RED 1.2.7 and earlier, which allows arbitrary path traversal via the...

Design/Logic Flaw

webcalendar before 1.2.7 shows the reason for a failed login e.g., "no such user"...

Cacti PHP Module Memory Corruption Vulnerability

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool through snmpget to get the data , using RRDtool drawing graphs to analyze , and provide data and user management features . A memory corruption vulnerability exists in Cacti 1.2.7 and earlier...

Cacti < 1.2.7 Information Disclosure Vulnerability - Windows

In Cacti, authenticated users may bypass authorization checks for viewing a graph via a direct graphjson.php request with a modified localgraphid parameter. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

DEBIAN-CVE-2019-17358

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the P...

CVE-2017-18535

The smokesignal plugin before 1.2.7 for WordPress has XSS...

Kanboard < 1.2.8 XSS Vulnerability

Kanboard is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:kanboard:kanboard"...

CVE-2018-1000506

Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery CSRF vulnerability in Settings page /wp-admin/options-general.php?page=metronet-tag-manager that can result in allows anybody to do almost anything an admin can. This attack appear to be exploitable via Logged in user must...

Roundcube Webmail < 1.1.10, 1.2.x < 1.2.7, 1.3.x < 1.3.3 File Disclosure Vulnerability

Roundcube Webmail is prone to a file disclosure vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...

WordPress SmokeSignal plugin <=1.2.6 - Authenticated Stored XSS (Cross-Site Scripting) vulnerability

Authenticated Stored XSS Cross-Site Scripting vulnerability found in WordPress SmokeSignal plugin =1.2.6 by Paul Dannewitz. The plugin allows users to communicate by messages. However, messages not sanitized before they are displayed. It allows an attacker to inject malicious script. Users with l...

WebCalendar Directory Traversal Vulnerability

WebCalendar is a web-based calendar application. The application has features such as viewing calendars, adding reminders, making schedules and more. A directory traversal vulnerability exists in WebCalendar 1.2.7 and earlier versions. A remote attacker can exploit this vulnerability to read...

BUFFALO WAPM-1166D and WAPM-APG600H Authentication Bypass Vulnerabilities

The BUFFALO WAPM-1166D and WAPM-APG600H are both wireless LAN access point devices from BUFFALO Japan. A security vulnerability exists in the WAPM-1166D using firmware version 1.2.7 and earlier and the WAPM-APG600H using firmware version 1.16.1 and earlier. A remote attacker can exploit this...

Vulnerabilities of the Red Hat Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The krb5-1.2.7 package of the Red Hat Linux operating system has multiple vulnerabilities. Exploitation of these vulnerabilities can lead to breaches of confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

WordPress Photo Gallery Blind SQL injection Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...

PT-2014-3509 · Red Hat · Red Hat Openshift Enterprise

Name of the Vulnerable Software and Affected Versions: Red Hat OpenShift Enterprise versions 1.2.7 through 2.0.5 Description: The issue allows local users to obtain credentials and other sensitive information by reading a configuration file due to world-readable permissions. This affects the...

PT-2014-3526 · Red Hat · Red Hat Openshift Enterprise

Name of the Vulnerable Software and Affected Versions: Red Hat OpenShift Enterprise versions 2.0.5, 1.2.7 and earlier Description: The issue allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to a passthrough trigger, due to...

Fedora 18 : php-pecl-radius-1.2.7-1.fc18 (2013-11998)

Version 1.2.7 - Fix a security issue in radiusgetvendorattr by enforcing checks of the VSA length field against the buffer size. Adam Version 1.2.6 - Support added for PHP 5.4 and 5.5. Johannes - Fixed bug 60885 Radius module causing Apache segmentation fault. Adam - Fixed a crash when calling...

[ MDVSA-2013:192 ] php-radius

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:192 http://www.mandriva.com/en/support/security/ Package : php-radius Date : July 2, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A security vulnerability was discovered and...

CVE-2013-1652

Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors...

rubygem-rack: Rack::Auth:: AbstractRequest DoS

Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."...