rhbb

3 exploits Active since Mar 2019
CVE-2019-17671 NOMISEC MEDIUM SUSPICIOUS
WordPress < 5.2.4 - Unauthenticated Exposure of Sensitive Information via Static Query Property
In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.
2 stars
CVSS 5.3
CVE-2019-7609 NOMISEC CRITICAL WORKING POC
Kibana Timelion Prototype Pollution RCE
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
1 stars
CVSS 10.0
CVE-2019-13956 NOMISEC CRITICAL STUB
Discuz!ML 3.2-3.4 - Remote Code Execution via Language Cookie Injection
Discuz!ML 3.2 through 3.4 allows remote attackers to execute arbitrary PHP code via a modified language cookie, as demonstrated by changing 4gH4_0df5_language=en to 4gH4_0df5_language=en'.phpinfo().'; (if the random prefix 4gH4_0df5_ were used).
CVSS 9.8