Dynamic Content for Elementor < 1.9.6 - Authenticated RCE

The PHP Raw Widget https://www.dynamic.ooo/widget/php-raw/ of the Dynamic Content for Elementor plugin before 1.9.6 did not properly check for user permissions, allowing accounts with a role as low as editor to perform RCE attacks. POST /wp-admin/admin-ajax.php HTTP/1.1 Host: example.com...

Updated unbound packages fix potential security vulnerabilities

Updated unbound package to version 1.9.6 to fix various potential security vulnerabilities...

nostromo nhttpd path traversal vulnerability

nostromo nhttpd is an open source web server . A path traversal vulnerability exists in the 'httpverify' function in nostromo nhttpd 1.9.6 and earlier. The vulnerability stems from a failure of a network system or product to properly filter special elements in the path of a resource or file. An...

CVE-2019-16278

Directory Traversal in the function httpverify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request...

Security feature bypass

In Huawei HiRouter-CD20-10 with the versions before 1.9.6 and WS5200-10 with the versions before 1.9.6, there is a plug-in signature bypass vulnerability due to insufficient plug-in verification. An attacker may tamper with a legitimate plug-in to build a malicious plug-in and trick users into...

CVE-2018-7937

In Huawei HiRouter-CD20-10 with the versions before 1.9.6 and WS5200-10 with the versions before 1.9.6, there is a plug-in signature bypass vulnerability due to insufficient plug-in verification. An attacker may tamper with a legitimate plug-in to build a malicious plug-in and trick users into...

CVE-2018-7937

In Huawei HiRouter-CD20-10 with the versions before 1.9.6 and WS5200-10 with the versions before 1.9.6, there is a plug-in signature bypass vulnerability due to insufficient plug-in verification. An attacker may tamper with a legitimate plug-in to build a malicious plug-in and trick users into...

CVE-2018-1002100

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files...

Command injection

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files...

WordPress WPGlobus plugin cross-site scripting vulnerability (CNVD-2018-01277)

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site.WPGlobus plugin is used in one of the plugin used to create a multi-language blog. A cross-site scripting vulnerabili...

WordPress WPGlobus plugin cross-site scripting vulnerability (CNVD-2018-01287)

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site.WPGlobus plugin is used in one of the plugin used to create a multi-language blog. A cross-site scripting vulnerabili...

Fedora 25 : subversion (2017-b9e4c24094)

This update includes the latest stable release of Apache Subversion, version 1.9.6. User-visible changes: Client-side bugfixes : - cp/mv: improve error message when target is an unversioned dir - merge: reduce memory usage with large amounts of mergeinfo issue 4667 Server-side bugfixes : -...

Cisco Meeting Server Authentication Bypass Vulnerability

Cisco Meeting Server formerly known as Acano Conferencing Server is the United States Cisco Cisco company's set of audio and video conferencing server software. An authentication bypass vulnerability exists in the web-based management interface in Cisco Meeting Server versions 1.8.18 to 1.9.6 and...

phpLiteAdmin < 1.9.7 Multiple Vulnerabilities

phpLiteAdmin is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2016-5367

Name of the Vulnerable Software and Affected Versions Ansible versions prior to 1.9.6-1 Ansible versions 2.x prior to 2.0.2.0 Description The issue allows local users to write to arbitrary files or gain privileges via a symlink attack on several files and directories, including...

FreeBSD : moinmoin -- Multiple vulnerabilities (a264b1b0-5726-11e2-9483-14dae938ec40)

MoinMoin developers report the following vulnerabilities as fixed in version 1.9.6 : - remote code execution vulnerability in twikidraw/anywikidraw action, - path traversal vulnerability in AttachFile action, - XSS issue, escape page name in rss link. CVE entries at MITRE furher clarify : Multipl...

moinmoin -- Multiple vulnerabilities

MoinMoin developers report the following vulnerabilities as fixed in version 1.9.6: remote code execution vulnerability in twikidraw/anywikidraw action, path traversal vulnerability in AttachFile action, XSS issue, escape page name in rss link. CVE entries at MITRE furher clarify: Multiple...

VulnCheck KEV: CVE-2012-6081

Multiple unrestricted file upload vulnerabilities in the 1 twikidraw action/twikidraw.py and 2 anywikidraw action/anywikidraw.py actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable...

AbsoluteFTP 'LIST' Command Remote Buffer Overflow Vulnerability

AbsoluteFTP is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Zend Framework 1.9.6 - Multiple Input Validation Vulnerabilities / Security Bypass

source: https://www.securityfocus.com/bid/37809/info Zend Framework is prone to multiple input-validation vulnerabilities and a weakness: - Multiple cross-site scripting issues - An HTML-injection issue - A security-bypass weakness An attacker may leverage the cross-site scripting issues and...