8924 matches found
Design/Logic Flaw
The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion...
CVE-2016-10991
The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion...
CVE-2016-10991
The CVE-2016-10991 entry concerns the WordPress plugin imdb-widget (before version 1.0.9) and is affected by a Local File Inclusion (LFI) vulnerability. The connected documents consistently describe the same issue across multiple sources (NVD, Red Hat, CVE lists, WPVulnDB) with the vulnerable com...
CVE-2016-10991
The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion...
PT-2019-7784
Name of the Vulnerable Software and Affected Versions imdb-widget plugin versions prior to 1.0.9 Description The issue allows for Local File Inclusion. Recommendations For versions prior to 1.0.9, update to version 1.0.9 or later to resolve the issue...
CVE-2016-10991: Improper Input Validation
The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion...
CVE-2019-10074
An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never...
CVE-2019-10074
An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never...
Input validation
An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never...
CVE-2019-10074
An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never...
CVE-2019-10074
CVE-2019-10074 affects Apache OFBiz where Freemarker markup in a Form Widget textarea can trigger remote code execution if encoding is disabled on that field (notably in the Customer Request “story” input of Order Manager). Root cause: disabling encoding on a user input field allows untrusted mar...
PT-2019-11418
Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 16.11.06 Description: A remote code execution RCE issue is possible when Freemarker markup is entered in a textarea field of an Apache OFBiz Form Widget, specifically when encoding has been disabled on such a...
CVE-2019-10074: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never...
CVE-2019-15954
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution RCE on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of...
CVE-2019-15954
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution RCE on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of...
CVE-2019-15954: Total.js CMS 12 Widget Remote Code Execution
Total.js is a Node.js Framework for building e-commerce applications, REST services, real-time apps, or apps for Internet of Things IoT, etc. Total.js CMS is a Content Management System application that is part of the Total.js framework. A commercial version is also available, and can be seen use...
Totaljs CMS 12.0 Widget Creation Code Injection
Author/Discoverer: Riccardo Krauter @CertimeterGroup + Title: Totaljs CMS Authenticated Code injection on widget creation. + Affected software: Totaljs CMS 12.0 + Description: An authenticated user with “widgets” privilege can gain RCE on the remote server by creating a malicious widget with a...
Total.js CMS 12 Widget JavaScript Code Injection
This module exploits a vulnerability in Total.js CMS. The issue is that a user with admin permission can embed a malicious JavaScript payload in a widget, which is evaluated server side, and gain remote code execution. Module Options msf use exploit/multi/http/totaljs/cmswidgetexec msf...