CVE-2019-19645

CVE-2019-19645 affects SQLite. Vulnerable component: alter.c in SQLite up to version 3.30.1. Description: attackers can trigger infinite recursion through certain self-referential views when used with ALTER TABLE statements. Impact stated as infinite recursion, implying potential crash/denial of ...

PT-2019-4848

Name of the Vulnerable Software and Affected Versions SQLite versions prior to 3.30.1 Description The issue is related to a type determination error in the SQLite database management system. It can be triggered by certain types of self-referential views in conjunction with ALTER TABLE statements,...

CVE-2019-19645: Uncontrolled Recursion

alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements...

CVE-2019-14449

An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. Malicious impala queries can result in Cross Site Scripting XSS when viewed within this product...

CVE-2011-3373

Drupal Views Builk Operations VBO module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabled and the "Modify node taxonomy terms" action is used. A remote attacker could provide a specially-crafted URL that could lead to cross-sit...

CVE-2011-3373

The CVE-2011-3373 entry affects the Drupal module Views Bulk Operations (VBO) for Drupal 6.x, specifically versions 6.x-1.0 through 6.x-1.10 . The vulnerability stems from improper escaping of help text in the vocabulary when user tagging is enabled and the action “Modify node taxonomy terms” is ...

PT-2019-6670

Name of the Vulnerable Software and Affected Versions Drupal Views Bulk Operations VBO module versions 6.x-1.0 through 6.x-1.10 Description The issue arises from the improper escaping of vocabulary help in the Drupal Views Bulk Operations VBO module when user tagging is enabled and the "Modify no...

CVE-2011-3373: Improper Neutralization of Input During Web Page Generation

Drupal Views Builk Operations VBO module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabled and the "Modify node taxonomy terms" action is used. A remote attacker could provide a specially-crafted URL that could lead to cross-sit...

Apache Airflow vulnerable to XSS and local file disclosure

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process...

CVE-2019-17550

The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the b2sid parameter. The component is: views/b2s/post.calendar.php. The attack vector is: When the Administrator is logge...

CVE-2019-17550

The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the b2sid parameter. The component is: views/b2s/post.calendar.php. The attack vector is: When the Administrator is logge...

CVE-2019-17550

The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the b2sid parameter. The component is: views/b2s/post.calendar.php. The attack vector is: When the Administrator is logge...

CVE-2019-17550: Improper Neutralization of Input During Web Page Generation

The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the b2sid parameter. The component is: views/b2s/post.calendar.php. The attack vector is: When the Administrator is logge...

PT-2019-15200

Name of the Vulnerable Software and Affected Versions Blog2Social plugin versions prior to 5.9.0 Description The issue allows an attacker to execute arbitrary HTML and JavaScript code via the b2s id parameter. This occurs in the views/b2s/post.calendar.php component when the Administrator is logg...

Administration Views - Moderately critical - Access bypass - SA-CONTRIB-2019-076

This module replaces administrative overview/listing pages with actual views for superior usability. The module doesn't sufficiently check user access when using the "Menu system path" access handler on a Views displays other than "System". Update: This project had been unsupported due to this...

CVE-2014-1214: Unrestricted Upload of File with Dangerous Type

views/upload.php in the ProJoom Smart Flash Header NovaSFH component 3.0.2 and earlier for Joomla! allows remote attackers to upload and execute arbitrary files via a crafted 1 dest parameter and 2 arbitrary extension in the Filename parameter...

CVE-2019-9757

An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read...

CVE-2019-16967: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form html\admin\modules\manager\views\form.php, an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via G...

CVE-2016-11013

The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS...

PT-2019-7806

Name of the Vulnerable Software and Affected Versions wp-listings plugin versions prior to 2.0.2 Description The issue is related to an XSS problem in the includes/views/single-listing.php file of the wp-listings plugin for WordPress. Recommendations For versions prior to 2.0.2, update to version...