effect project effect vulnerabilities and exploits

(subscribe to this query)

9.8

CVSSv3

effect up to and including 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument.

Effect Project Effect

NA

Cross-site scripting (XSS) vulnerability in the Banner Effect Header plugin prior to 1.2.8 for WordPress allows remote malicious users to inject arbitrary web script or HTML via the banner_effect_divid parameter in the BannerEffectOptions page to wp-admin/options-general.php.

Banner Effect Header Project Banner Effect Header

NA

Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote malicious users to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the banner_effect_email parameter i...

Banner Effect Header Project Banner Effect Header 1.2.6

6.5

CVSSv3

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service...

Snakeyaml Project Snakeyaml Fedoraproject Fedora 36 Fedoraproject Fedora 37

2 Github repositories

9.8

CVSSv3

PHPMailer 6.1.8 up to and including 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unrea...

Phpmailer Project Phpmailer Wordpress Wordpress

1 Github repository

7.5

CVSSv3

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

Xstream Project Xstream

7.5

CVSSv3

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of ser...

Jettison Project Jettison Debian Debian Linux 10.0 Debian Debian Linux 11.0

7.5

CVSSv3

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denia...

Xstream Project Xstream Fasterxml Woodstox

7.5

CVSSv3

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of ser...

Jettison Project Jettison Debian Debian Linux 10.0 Debian Debian Linux 11.0

5.5

CVSSv3

A flaw was found in libtpms in versions prior to 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the in...

Libtpms Project Libtpms Redhat Enterprise Linux 8.0 Fedoraproject Fedora 33

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook