Larry0

The issue allows local users to discover MySQL credentials by listing a process and its arguments. This is due to a flaw in the `execute()` function in the `/datamapper/dm-rails/blob/master/lib/dm-rails/storage.rb` file, which exposes sensitive information via the process table. A local attack may gain access to MySQL credential information.

O plugin do WordPress mb.miniAudioPlayer — um reprodutor de áudio HTML5 para seus arquivos MP3 — está sujeito a várias vulnerabilidades, incluindo vulnerabilidades de proxy aberto e de contorno de segurança, devido à sua falha em verificar adequadamente as entradas fornecidas pelo usuário. Um invasor pode aproveitar essas falhas para ocultar ataques direcionados a um site alvo por trás de um site vulnerável ou para realizar ações que, de outra forma, seriam restritas. O invasor pode, posteriormente, baixar arquivos com as extensões mp3, mp4a, wav e ogg de qualquer local ao qual o aplicativo do servidor web tenha acesso de leitura no sistema.

A vulnerabilidade está relacionada à injeção de SQL nos parâmetros order e column no arquivo Records.php. Isso se deve à falta de medidas de proteção para a estrutura da consulta SQL na biblioteca DataTables. A exploração dessa vulnerabilidade poderia permitir que um invasor remoto comprometesse a confidencialidade, integridade e disponibilidade de informações protegidas.

O problema está relacionado à falta de proteção contra a exploração da estrutura de consultas SQL, o que pode permitir que um invasor remoto comprometa a confidencialidade, integridade e disponibilidade das informações protegidas. A vulnerabilidade envolve injeção de SQL com os parâmetros `start` e `length` no arquivo Records.php.

O problema está relacionado à falta de proteção contra a exploração da estrutura de consultas SQL, o que pode permitir que um invasor remoto comprometa a confidencialidade, a integridade e a disponibilidade das informações protegidas. A vulnerabilidade envolve injeção de SQL com o parâmetro `search` no arquivo Records.php.

**Nome do software vulnerável e versões afetadas: DeleGate versão 9.9.13 Descrição: A vulnerabilidade permite que usuários locais obtenham privilégios, conforme demonstrado pelo programa dgcpnod setuid. Recomendações: Para a versão 9.9.13 do DeleGate, no momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

The issue allows remote attackers to inject malicious html in the "/tmp" directory.

The issue allows SQL Injection due to unsanitized variables, including `mapTemplateName`, `mapName`, `mapSettingsXML`, `parentCSSXML`, `photoCSSXML`, `mapCSSXML`, `mapHTML`, and `mapID`.

The issue allows for arbitrary anonymous uploads to the phone's storage.

The issue concerns a Command Injection vulnerability. It occurs when a user-supplied `url` variable is passed to the shell, allowing for potential command injection.

The issue allows path traversal when specifying file names, enabling the creation of files outside of the upload directory. This is due to a vulnerability in the MapPinImageUpload.php and MapPinIconSave.php files.

A vulnerability in the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root path of the webserver.

Name of the Vulnerable Software and Affected Versions: WordPress Arigato Autoresponder and News letter version 2.5.1.8 Description: The issue is related to a reflected XSS vulnerability that requires administrative privileges to exploit. It is located in the integration-contact-form.html.php file at line 15 and can be triggered via a POST request using the `html id` variable. Recommendations: For WordPress Arigato Autoresponder and News letter version 2.5.1.8, consider restricting access to the integration-contact-form.html.php file until a patch is available, and avoid using the `html id` variable in POST requests to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue involves an XSS vulnerability that can be exploited via a POST request variable `classes` in the integration-contact-form.html.php file at line 14. This vulnerability requires administrative privileges to exploit. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WordPress Arigato Autoresponder and News letter version 2.5.1.8 Description: The issue is related to a reflected XSS vulnerability that requires administrative privileges to exploit. It is located in the list-user.html.php file and can be triggered via a GET request using the `offset` variable. Recommendations: For WordPress Arigato Autoresponder and News letter version 2.5.1.8, consider restricting access to the list-user.html.php file and avoid using the `offset` variable in GET requests until a patch is available. As a temporary workaround, restrict administrative privileges to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: WordPress Arigato Autoresponder and News letter version 2.5.1.8 Description: The issue is a reflected XSS vulnerability that requires administrative privileges to exploit. Recommendations: For WordPress Arigato Autoresponder and News letter version 2.5.1.8, update to a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: WordPress Arigato Autoresponder and News letter version 2.5.1.8 Description: The issue is a reflected XSS vulnerability that requires administrative privileges to exploit. Recommendations: For WordPress Arigato Autoresponder and News letter version 2.5.1.8, update to a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: No specific software or version is mentioned. Description: The issue involves an XSS vulnerability that can be exploited via the `filter signup date` parameter in the bft list.html.php file, specifically at line 43. This vulnerability requires administrative privileges to exploit. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WordPress Arigato Autoresponder and News letter version 2.5.1.8 Description: The issue is related to a reflected XSS vulnerability that requires administrative privileges to exploit. It is located in the unsubscribe.html.php file and can be triggered via a GET request to the `email` variable. Recommendations: For WordPress Arigato Autoresponder and News letter version 2.5.1.8, consider restricting access to the unsubscribe.html.php file until a patch is available. As a temporary workaround, avoid using the `email` variable in the affected GET request to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: WordPress Arigato Autoresponder and Newsletter version 2.5.1.8 Description: The issue is related to a blind SQL injection vulnerability that can be exploited via the `del ids` variable by sending a POST request. This vulnerability requires administrative privileges to exploit. Recommendations: For WordPress Arigato Autoresponder and Newsletter version 2.5.1.8, consider restricting access to the `del ids` variable to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the `del ids` variable in POST requests to prevent potential SQL injection attacks.