action view project action view vulnerabilities and exploits

The create_post_page AJAX action of the Custom Post View Generator WordPress plugin up to and including 0.4.6 (available to authenticated user) does not sanitise or escape user input before outputting it back in the response, leading to a Reflected Cross-Site issue

Custom Post View Generator Project Custom Post View Generator

CVSSv2

An issue exists in MantisBT prior to 2.24.4. A missing access check in bug_actiongroup.php allows an attacker (with rights to create new issues) to use the COPY group action to create a clone, including all bugnotes and attachments, of any private issue (i.e., one having Private ...

Mantisbt Mantisbt

4.3

CVSSv2

In Action View prior to 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS a...

Action View Project Action View Debian Debian Linux 10.0 Fedoraproject Fedora 33

4.3

CVSSv2

jQuery prior to 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

127 Github repositories

1.9

CVSSv2

It was found that xorg-x11-server prior to 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is...

X.org Xorg-server Debian Debian Linux 7.0

1 Github repository

7.5

CVSSv2

SQL Injection exists in the Pinterest Clone Social Pinboard 2.0 component for Joomla! via the pin_id or user_id parameter in a task=getlikeinfo action, the ends parameter in a view=gift action, the category parameter in a view=home action, the uid parameter in a view=pindisplay a...

Social Pinboard Project Social Pinboard 2.0

1 EDB exploit

4.3

CVSSv2

MISP prior to 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js.

Misp-project Misp

CVSSv2

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 prior to 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote malicious users to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrat...

4 EDB exploits2 Nmap scripts308 Github repositories4 Articles

7.5

CVSSv2

SQL injection vulnerability in index.php Pragyan CMS 2.6.4 allows remote malicious users to execute arbitrary SQL commands via the fileget parameter in a view action and other unspecified vectors.

Pragyan Cms Project Pragyan Cms 2.6.4

1 EDB exploit

7.5

CVSSv2

Multiple SQL injection vulnerabilities in project alumni 1.0.9 and previous versions allow remote malicious users to execute arbitrary SQL commands via the year parameter to (1) view.page.inc.php, which is reachable through a view action to index.php; or (2) the year parameter to...

Project Alumni Project Alumni

1 EDB exploit

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

action view project action view vulnerabilities and exploits

Vulmon Search

About

Products

Connect