WordPress wp-members plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. wp-members is a website membership plugin used in it. Cross-site request forgery vulnerability exists in WordPress wp-member plugin...

CVE-2019-10383

CVE-2019-10383 is a stored XSS in Jenkins up to 2.191 (LTS up to 2.176.2) where an attacker with Overall/Administer permissions can abuse the update center URL to inject HTML/JavaScript in update center pages. Affected component is Jenkins update center handling; root cause is insufficient escapi...

ibm-application-security showed plain text password in job configuration form fields

ibm-application-security stores service passwords in job configurations. While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting...

WordPress posts-in-page plugin path traversal vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. posts-in-page is a plugin for embedding posts in pages. A path traversal vulnerability exists in the WordPress posts-in-page plugin. T...

CVE-2019-15533

XENFCoreSharp (pre-2019-07-16) is affected by CVE-2019-15533: it allows SQL injection in web/verify.php. The connected documents confirm the vulnerable component and input point but do not provide exploit specifics, affected version ranges beyond the date, or remediation details in the supplied s...

WordPress custom-sidebars plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. custom-sidebars is a custom feature list plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...

CVE-2019-13599

CVE-2019-13599 affects CentOS Web Panel (CWP) 0.9.8.848, where the login process can be used to determine if a username is valid by comparing response times, creating a user-enumeration timing side-channel. The vulnerability is documented across multiple sources (NVD, Red Hat, CNVD, PRION, etc.) ...

WordPress peters-login-redirect plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. peters-login-redirect is a redirection plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...

Kimai 2 - Persistent Cross-Site Scripting

Exploit Title: Kimai 2- persistent cross-site scripting XSS Date: 07/15/2019 Exploit Author: osamaalaa Vendor Homepage: link Software Link: https://github.com/kevinpapst/kimai2 Fixed on Github : https://github.com/kevinpapst/kimai2/pull/962 Version: 2 1-Normal user will try to add timesheet from...

CVE-2019-15062

An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element containing a user/card.php CSRF request in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. The protection mechanism for CSRF is to check the Referer...

CVE-2019-3635

Exfiltration of Data in McAfee Web Gateway MWG 7.8.2.x prior to 7.8.2.12 allows attackers to obtain sensitive data via crafting a complex webpage that will trigger the Web Gateway to block the user accessing an iframe...

Microsoft Windows Graphics Component CVE-2019-1149 Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. Successful exploits may allow an attacker to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft Office 2019...

SEC Investigating Data Leak at First American Financial Corp.

The U.S. Securities and Exchange Commission SEC is investigating a security failure on the Web site of real estate title insurance giant First American Financial Corp. that exposed more than 885 million personal and financial records tied to mortgage deals going back to 2003, KrebsOnSecurity has...

journals.library.columbia.edu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-930785 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

web.yellow-cap.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-930027 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Breaking (Bad) Cross-Site Request Forgery Protection – The Netgear Nighthawk M1

What is CSRF? Cross-site Request Forgery CSRF is a descriptive term, but pretty oblique if you don’t know exactly what it means. Broken down, it’s pretty simple: A malicious web page running in your browser can send requests to other sites. When it sends those requests, it’ll use the current...

CVE-2019-1954

A vulnerability in the web-based management interface of Cisco Webex Meetings Server Software could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to...

Adive Framework 2.0.7 - Cross-Site Request Forgery

Exploit Title: Adive Framework 2.0.7 – Cross-Site Request Forgery CSRF Date:02/08/2019. Exploit Author: Pablo Santiago Vendor Homepage: https://adive.es Software Link: https://github.com/ferdinandmartin/adive-php7 Version: 2.0.7 Tested on: Windows and Kali linux CVE :2019-14346 1. Technical...

New Relic: Stored XSS at APM transaction map (transactionName field)

Hey team, You've recently fixed my previous report about transaction map stored XSS 549084 and the fix is correct, I wasn't successful with finding a bypass. But I've discovered another vulnerable transaction map field transactionName. An attacker can inject a payload inside this field and then,...

bisoudeve.misscoquines.com Cross Site Scripting vulnerability

Security Researcher Track2 Helped patch 214 vulnerabilities Received 2 Coordinated Disclosure badges Received 1 recommendations , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting bisoudeve.misscoquines.com website and its users. Following...