PT-2020-16073 · Accesspress Themes · Accesspress Themes Wp Floating Menu

Name of the Vulnerable Software and Affected Versions: AccessPress Themes WP Floating Menu version 1.3.0 Description: The issue concerns a Cross Site Scripting XSS problem. It is exploited via the id GET parameter. Recommendations: For version 1.3.0, update to a newer version that contains a fix...

CVE-2020-10284

No authentication is required to control the robot inside the network, moreso the latest available user manual shows an option that lets the user to add a password to the robot but as in xarmstudio 1.3.0 the option is missing from the menu. Assuming manual control, even by forcefully removing the...

Android o2 Business 1.2.0 Open Redirect

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: o2 Business for Android Vendor URL: https://play.google.com/store/apps/details?id=telefonica.de.o2business Type: Open Redirect CWE-601 Date found: 2020-04-16 Date published: 2020-07-01 CVSSv...

TownHub < 1.3.0 - Unauthenticated Reflected XSS

Unauthenticated Reflected XSS vulnerability was discovered in the «TownHub - Directory & Listing WordPress Theme», tested version — v1.2.9. Edit WPScanTeam June 17th, 2020 - Confirmed & Escalated to Envato June 18th, 2020 - v1.3.0 released, fixing the issue...

Command Injection

Overview clamscan is an Use Node JS to scan files on your server with ClamAV's clamscan binary or clamdscan daemon. This is especially useful for scanning uploaded files provided by un-trusted sources. Affected versions of this package are vulnerable to Command Injection. It is possible to inject...

Unspecified Vulnerability in USC iLab cereal

USC iLab cereal is a C++ library for serialization. A security vulnerability exists in USC iLab cereal version 1.3.0 and earlier, which stems from the inability of a serialized 'std::sharedptr' variable to be serialized back to its original value. No details of the vulnerability are provided at...

Easy!Appointments Authorization Issues Vulnerability

Easy!Appointments is a web-based appointment and schedule management system. A security vulnerability exists in Easy!Appointments version 1.3.0. An attacker can exploit this vulnerability to bypass CAPTCHA protection...

CVE-2018-13060

Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue...

Debian: Security Advisory (DLA-2136-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Serpico Input Validation Error Vulnerability

Serpico is a penetration test report generation and collaboration tool. An input validation error vulnerability exists in Serpico version 1.3.0, which arises from a networked system or product that does not properly validate incoming data and can be exploited by an attacker to add an unlimited...

Serpico Cross-Site Scripting Vulnerability (CNVD-2020-03851)

Serpico is a penetration test report generation and collaboration tool. A cross-site scripting vulnerability exists in admin/adduser/UID in Serpico version 1.3.0, which stems from the lack of proper validation of client-side data in a WEB application and can be exploited by an attacker to execute...

Serpico Cross-Site Scripting Vulnerability (CNVD-2020-03856)

Serpico is a penetration test report generation and collaboration tool. A cross-site scripting vulnerability exists in Serpico version 1.3.0 in admin/listuser, which stems from the lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute...

BSON ObjectID Input Validation Error Vulnerability

BSON ObjectID is a module for creating and parsing ObjectIDs for use in Node.js. An input validation error vulnerability exists in BSON ObjectID version 1.3.0 for Node.js. The vulnerability stems from a network system or product that does not properly validate input data. An attacker could use th...

CloudBees Jenkins Team Concert Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site request forgery...

PT-2019-14721 · Jenkins · Jenkins Team Concert Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Team Concert Plugin versions 1.3.0 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs,...

CVE-2019-4428

IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

GHSA-7XXV-WPXJ-MX5V typed-ast Out-of-bounds Read

typedast 1.3.0 and 1.3.1 has an astforarguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source but not necessarily execute it may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that pars...

GHSA-M3JW-62M7-JJCM typed-ast Out-of-bounds Read

typedast 1.3.0 and 1.3.1 has a handlekeywordonlyargs out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source but not necessarily execute it may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that...

Design/Logic Flaw

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

PYSEC-2019-65

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...