call to action vulnerabilities and exploits

(subscribe to this query)

Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin prior to 2.5.1 for WordPress allow remote malicious users to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action to wp-admin/edit.php or (2) wp-cta-...

Inboundnow Call To Action

Github's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to connect to a GitHub repository. The runner and its documentation previously suggested passing the GitHub token as a command-line parameter t...

Github Codeql Action

Remedy AR System Server in BMC Remedy 7.1 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the identity of a different user, because userdata.js in the WOI:WorkOrderConsole component allows a username substitution inv...

Bmc Remedy Action Request System Server 7.1

The REST API TO MiniProgram WordPress plugin up to and including 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments

Minapper Rest Api To Miniprogram

The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability depends ...

Graniteds Graniteds 3.1.1

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this ...

Exadel Flamingo 2.2.0

Stack-based buffer overflow in Novell iPrint Client prior to 5.44 allows remote malicious users to execute arbitrary code via a long call-back-url parameter in an op-client-interface-version action.

Novell Iprint 4.34 Novell Iprint 4.36 Novell Iprint 5.40 Novell Iprint Novell Iprint 4.26 Novell Iprint 4.38 Novell Iprint 5.04 Novell Iprint 4.27 Novell Iprint 4.28 Novell Iprint 5.30 Novell Iprint 5.32 Novell Iprint 4.30 Novell Iprint 4.32 Novell Iprint 5.20b Novell Iprint 5.12

2 EDB exploits

The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose sensitive da...

Themidnightcoders Weborb For Java 5.1.1.0

The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI se...

Graniteds Graniteds 3.1.1

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability t...

Exadel Flamingo Amf-serializer 2.2.0

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook