454 matches found
Wordpress Yellow Pencil Plugin Flaws Actively Exploited
The maker of a WordPress plugin, Yellow Pencil Visual Theme Customizer, is asking all users to immediately update after it was discovered to have software vulnerabilities that are being actively exploited. The attacker exploiting these flaws has been behind several other recent plugin attacks the...
eDirectory - SQL Injection
eDirectory - SQL Injection Exploit Title: Admin auth bypass, SQLi and File Disclosure Google Dork: no defacers please ! Date: March 2019 reported to vendor without response :D Exploit Author: Efren Diaz Author contact: https://twitter.com/elefr3n Vendor Homepage: https://www.edirectory.com/...
eDirectory - SQL Injection
Exploit Title: Admin auth bypass, SQLi and File Disclosure Google Dork: no defacers please ! Date: March 2019 reported to vendor without response :D Exploit Author: Efren Diaz Author contact: https://twitter.com/elefr3n Vendor Homepage: https://www.edirectory.com/ Software Link: not available...
yellowpages.co.th XSS vulnerability
Open Bug Bounty ID: OBB-675791 Description| Value ---|--- Affected Website:| yellowpages.co.th Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidde...
indianyellowpages.com XSS vulnerability
Open Bug Bounty ID: OBB-638945 Description| Value ---|--- Affected Website:| indianyellowpages.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...
Datenstrom Yellow Cross-Site Scripting Vulnerability
Datenstrom Yellow is a system for creating small websites, blogs and wikis. A cross-site scripting vulnerability exists in Datenstrom Yellow version 0.7.3. A remote attacker can exploit this vulnerability to inject malicious code via an edit page...
Datenstrom Yellow Cross-Site Request Forgery Vulnerability
Datenstrom Yellow is a system for creating small websites, blogs and wikis. A cross-site request forgery vulnerability exists in the edit/ URI in Datenstrom Yellow version 0.7.3. A remote attacker could exploit this vulnerability to delete articles...
CVE-2018-10758
The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles...
CVE-2018-10758
The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles...
Cross site request forgery (csrf)
The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles...
CVE-2018-10758
The CVE-2018-10758 entry concerns Datenstrom Yellow 0.7.3, where the edit/ URI is vulnerable to CSRF via a delete action that can delete articles. The core issue is a CSRF flaw in the edit endpoint that allows unauthorized deletion of content, implying that an attacker could induce a logged-in us...
CVE-2018-10758
The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles...
CVE-2018-10758
The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles...
CVE-2018-10758: Cross-Site Request Forgery (CSRF)
The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles...
PT-2018-10087
Name of the Vulnerable Software and Affected Versions Datenstrom Yellow version 0.7.3 Description The issue concerns a CSRF vulnerability via the edit/ URI, specifically through a delete action, which can result in the deletion of articles. Recommendations For version 0.7.3, consider restricting...
CVE-2018-10726
A stored XSS vulnerability was found in Datenstrom Yellow 0.7.3 via an "Edit page" action. NOTE: the vendor disputes the relevance of this report because an installation accessible to untrusted users is supposed to have parserSafeMode=1 in system/config/config.ini to prevent XSS...
Cross site scripting
DISPUTED A stored XSS vulnerability was found in Datenstrom Yellow 0.7.3 via an "Edit page" action. NOTE: the vendor disputes the relevance of this report because an installation accessible to untrusted users is supposed to have parserSafeMode=1 in system/config/config.ini to prevent XSS...
CVE-2018-10726
A stored XSS vulnerability was found in Datenstrom Yellow 0.7.3 via an "Edit page" action. NOTE: the vendor disputes the relevance of this report because an installation accessible to untrusted users is supposed to have parserSafeMode=1 in system/config/config.ini to prevent XSS...
CVE-2018-10726
CVE-2018-10726 is a stored XSS vulnerability in Datenstrom Yellow 0.7.3 exploitable via the "Edit page" action. Multiple connected reports reiterate the vendor’s note that installations accessible to untrusted users should have parserSafeMode=1 in system/config/config.ini to prevent XSS. Affected...
CVE-2018-10726
A stored XSS vulnerability was found in Datenstrom Yellow 0.7.3 via an "Edit page" action. NOTE: the vendor disputes the relevance of this report because an installation accessible to untrusted users is supposed to have parserSafeMode=1 in system/config/config.ini to prevent XSS...