452 matches found
CVE-2020-24925
A Sensitive Source Code Path Disclosure vulnerability is found in ElkarBackup v1.3.3. An attacker is able to view the path of the source code jobs/sort where entire source code path is displayed in the browser itself helping the attacker identify the code structure...
CVE-2020-24924
A Persistent Cross-site Scripting vulnerability is found in ElkarBackup v1.3.3, where an attacker can steal the user session cookie using this vulnerability present on Policies action Name Parameter...
Sandbox Breakout / Prototype Pollution in notevil
Versions of notevil prior to 1.3.3 are vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing attacker to add or modify an object's prototype. Evaluating the payload tryab;catchee.constructor.constructor'return...
GHSA-9GXR-RHX6-4JGV Sandbox Breakout / Prototype Pollution in notevil
Versions of notevil prior to 1.3.3 are vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing attacker to add or modify an object's prototype. Evaluating the payload tryab;catchee.constructor.constructor'return...
GHSA-V3JV-WRF4-5845 Local Privilege Escalation in npm
Affected versions of npm use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the npm process has permission to write t...
Local Privilege Escalation in npm
Affected versions of npm use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the npm process has permission to write t...
HashBrown CMS 'postUser' function boost vulnerability
HashBrown CMS is an open source headless content management system CMS. A power lifting vulnerability exists in the 'postUser' function in HashBrown CMS version 1.3.3 and earlier. An attacker can exploit this vulnerability to change the hashed password of an administrator account or reset the...
WordPress Exquisite Ultimate Newspaper theme cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Exquisite Ultimate Newspaper theme is a newspaper website theme plugin used in it. A cross-site scripting vulnerability exists in...
Stored Cross-Site Scripting Vulnerability in CMSWing v1.3.3
CMSWing is a powerful e-commerce platform and CMS builder based on ThinkJS PC, mobile and WeChat public platform. A stored cross-site scripting vulnerability exists in CMSWing v1.3.3. The vulnerability allows attackers to obtain the administrator's cookie value...
CloudBees Pipeline Declarative Plugin Sandbox Bypass Vulnerability
CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , the tool is mainly used to monitor the order of repetitive work . Pipeline: Declarative Plugin is used in one of the command generator plugin...
Updated kdeconnect-kde packages fix security vulnerability
The kdeconnect-kde package has been updated to version 1.3.3, which fixes an issue with modern encryption algorithms being disabled with SSH, and also fixes several bugs and updates compatibility with the Android app...
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Operations Analytics Predictive Insights (CVE-2018-1621)
Summary Websphere Application Server WAS is shipped as a component of IBM Operations Analytics Predictive Insights. Information about a security vulnerability affecting WAS has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin:...
DEBIAN-CVE-2018-1000559
qutebrowser version introduced in v0.11.0 1179ee7a937fb31414d77d9970bac21095358449 contains a Cross Site Scripting XSS vulnerability in history command, qute://history page that can result in Via injected JavaScript code, a website can steal the user's browsing history. This attack appear to be...
Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Operations Analytics Predictive Insights (CVE-2017-1743)
Summary WebSphere Application Server is shipped as a component of IBM Operations Analytics Predictive Insights. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin...
Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affect WebSphere Application Server April 2016 CPU (CVE-2016-3426, CVE-2016-3427) shipped with Tivoli Netcool Performance Manager
Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed in the Oracle April 2016 Critical Patch Update, plus four additional vulnerabilities. These may affect some configurations of IBM...
Security Bulletin: FileNet Content Management Interoperability Services (CMIS), which is shipped with IBM Content navigator, is affected by the ability to execute remote attacker’s arbitrary code on a target machine vulnerability
Summary FileNet Content Management Interoperability Services CMIS, which is shipped with IBM Content Navigator, has addressed the following vulnerability. Ability to execute remote attacker’s arbitrary code on a target machine by leveraging the untrusted data in DiskFileItem class of FileUpload...
CVE-2018-11572
ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules - Manage modules - edit" action to the manager/ URI...
ClipperCMS Cross-Site Scripting Vulnerability (CNVD-2018-10866)
ClipperCMS is a content management system CMS. A cross-site scripting vulnerability exists in the 'Module name' field under the 'Modules - Manage modules - edit' tag in ClipperCMS version 1.3.3. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
ProtonVPN Elevation of Privilege Vulnerability
ProtonVPN for Windows is a free Windows-based VPN software for anonymous access to the Internet. A power lifting vulnerability exists in version 1.3.3 of ProtonVPN for Windows-based platforms, which stems from a NetNamedPipe endpoint created by the 'ProtonVPN Service' service that allows arbitrar...