Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

RHEL 8 : kernel (RHSA-2020:2102)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2102 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: Kernel: NetLabel: null pointer...

Session fixation

Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation...

VulnCheck KEV: CVE-2017-17733

Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request...

Authentication flaw

Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without credentials. An attacker can easily enable SSH from /admin/systemadvanced.php?lang=en and login with the default root password welc0me...

CVE-2019-16399

The CVE affects Western Digital WD My Book World through II devices (firmware 1.02.12 and earlier). The vulnerability stems from Broken Authentication via a hardcoded SSH credential path, enabling an attacker to access the /admin/ directory without credentials and login with the default root pass...

CVE-2018-18472

The CVE-2018-18472 entry concerns Western Digital WD My Book Live and WD My Book Live Duo (all versions) that expose a root Remote Command Execution flaw via shell metacharacters in the /api/1.0/rest/language_configuration language parameter. The vulnerability can be triggered by any actor that k...

CVE-2018-18472

Western Digital WD My Book Live and WD My Book Live Duo all versions have a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/languageconfiguration language parameter. It can be triggered by anyone who knows the IP address of the affected device, as exploited in the...

WordPress Contact Form by WD plugin <= 1.13.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Panagiotis Vagenas in WordPress Contact Form by WD plugin versions = 1.13.4. Solution Update the WordPress Contact Form by WD plugin to the latest available version at least 1.13.5...

Form Maker by 10Web < 1.13.5 - Cross-Site Request Forgery (CSRF) to LFI

Form Maker by WD plugin suffers from a CSRF issue that could lead to an LFI attack...

WordPress plugin ad manager wd arbitrary file download vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An arbitrary file download vulnerability exists in the WordPress plugin ad manager wd. An attacker can exploit the...

WordPress Ad Manager WD 1.0.11 Arbitrary File Download

Exploit Title: WordPress Plugin ad manager wd v1.0.11 - Arbitrary File Download Google Dork: N/A Date: 25.01.2019 Vendor Homepage: https://web-dorado.com/products/wordpress-ad-manager-wd.html Software: https://wordpress.org/plugins/ad-manager-wd Version: 1.0.11 Tested on: Win7 x64, Exploit Author...

WordPress Plugin Ad Manager WD 1.0.11 - Arbitrary File Download

Exploit Title: WordPress Plugin ad manager wd v1.0.11 - Arbitrary File Download Google Dork: N/A Date: 25.01.2019 Vendor Homepage: https://web-dorado.com/products/wordpress-ad-manager-wd.html Software: https://wordpress.org/plugins/ad-manager-wd Version: 1.0.11 Tested on: Win7 x64, Exploit Author...

WordPress Plugin Ad Manager WD 1.0.11 - Arbitrary File Download

WordPress Plugin Ad Manager WD 1.0.11 - Arbitrary File Download Exploit Title: WordPress Plugin ad manager wd v1.0.11 - Arbitrary File Download Google Dork: N/A Date: 25.01.2019 Vendor Homepage: https://web-dorado.com/products/wordpress-ad-manager-wd.html Software:...

CVE-2018-16164

Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-16164

Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-16164

CVE-2018-16164 is a stored cross-site scripting vulnerability in the WordPress plugin Event Calendar WD (Web-Dorado) for version 1.1.21 and earlier. The flaw allows a logged-in attacker to inject arbitrary scripts/HTML via unspecified vectors (CWE-79). Impact is an arbitrary script execution in a...

CVE-2018-16164

Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

Western Digital My Cloud / WD Cloud Products Detection Consolidation

Consolidation of Western Digital My Cloud product Called Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...