CVE-2021-21354 Open redirect in pollbot

Pollbot is open source software which "frees its human masters from the toilsome task of polling for the state of things during the Firefox release process." In Pollbot before version 1.4.4 there is an open redirection vulnerability in the path of "https://pollbot.services.mozilla.com/". An...

CVE-2021-21354

Pollbot (open source) before version 1.4.4 contains an open redirect vulnerability in the path https://pollbot.services.mozilla.com/. An attacker can induce redirection to a attacker-controlled site (e.g., via a payload like //evil.com/). The issue affects versions prior to 1.4.4 and is fixed in ...

WordPress site-offline plugin cross-site request forgery vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress site-offline plugin prior to...

GHSA-9HQJ-38J2-5JGM Command Injection in ascii-art

Versions of ascii-art before 1.4.4 are vulnerable to command injection. This is exploitable when user input is passed into the argument of the ascii-art preview command. Example Proof of concept: ascii-art preview 'doom"; touch /tmp/malicious; echo "' Given that the input is passed on the command...

Command Injection in ascii-art

Versions of ascii-art before 1.4.4 are vulnerable to command injection. This is exploitable when user input is passed into the argument of the ascii-art preview command. Example Proof of concept: ascii-art preview 'doom"; touch /tmp/malicious; echo "' Given that the input is passed on the command...

Unspecified Vulnerability in MISP MISP-maltego

MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis.MISP-maltego is a Maltego MISP integration tool that enables you to view the data in your...

Fedora 31 : roundcubemail (2020-35e12da5fe)

Version 1.4.4 This is a service and security update to the stable version 1.4 of Roundcube Webmail. It contains four fixes for recently reported security vulnerabilities as well a number of general improvements from our issue tracker. - Fix bug where attachments with Content-Id were attached to t...

UBUNTU-CVE-2020-12626

An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered...

PT-2020-3643 · Roundcube +3 · Roundcube Webmail +3

Name of the Vulnerable Software and Affected Versions: Roundcube Webmail versions prior to 1.4.4 Description: The issue is related to a CSRF attack that can cause an authenticated user to be logged out. This is because POST was not considered, leading to insufficient protection against cross-site...

Improper access control

X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates ar...

UBUNTU-CVE-2020-8124

Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks...

CVE-2020-8124

Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks...

FUEL CMS Cross-Site Request Forgery Vulnerability (CNVD-2021-18031)

FUEL CMS is a content management system CMS based on the Codelgniter framework. A cross-site request forgery vulnerability exists in the blocks/create/Create Blocks section of the Admin console in FUEL CMS version 1.4.4. The vulnerability stems from the WEB application not adequately verifying th...

FUEL CMS Cross-Site Scripting Vulnerability (CNVD-2019-41832)

FUEL CMS is a content management system CMS based on the Codelgniter framework. A cross-site scripting vulnerability exists in the Create Blocks section of the Admin console in FUEL CMS version 1.4.4, which stems from a lack of proper validation of client-side data in the WEB application and can ...

WPS Cleaner <= 1.4.4 - Multiple Issues

CSRF, Media Dislcosure...

UBUNTU-CVE-2018-1000888

PEAR ArchiveTar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the ArchiveTar class. There are several file operations with $vheader'filename' as parameter such as fileexists, isfile, isdir, etc. When extract is called without a specific prefix path, we can trigger...

Nginx < 1.4.4 ngx_parse_http Security Bypass

According to the self-reported version in the Server response header, the installed version of nginx is greater than 0.8.41 but prior to 1.4.4 / 1.5.7. It is, therefore, affected by a security bypass vulnerability in 'ngxhttpparse.c' when a file with a space at the end of the URI is requested. No...

Elastic Logstash 'CVE-2015-5378' Man in the Middle Security Bypass Vulnerability - Linux

Elastic Logstash is prone to a security bypass vulnerability. This VT has been deprecated and merged into the VT VT SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Nootka Command Injection Vulnerability

Nootka is a mobile application for learning classical music notation. A security vulnerability exists in Nootka 1.4.4 and earlier versions. A remote attacker can exploit the vulnerability to execute arbitrary operating system commands...

Foreman Cross-Site Scripting Vulnerability (CNVD-2017-34618)

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A cross-site scripting vulnerability exists in the search auto-completion feature in Foreman versions...