228 matches found
PT-2024-40529 · Unknown · Readthedocs-Sphinx-Search
Name of the Vulnerable Software and Affected Versions: readthedocs-sphinx-search versions prior to 0.3.2 Description: This issue could have allowed an attacker to include arbitrary HTML content in search results by having a user search a malicious project. The problem was due to the search client...
CVE-2023-27435
Cross-Site Request Forgery CSRF vulnerability in Sami Ahmed Siddiqui HTTP Auth plugin = 0.3.2 versions...
Authentication flaw
A vulnerability was found in didi KnowSearch 0.3.2/0.3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file /api/es/admin/v3/security/user/1. The manipulation leads to unprotected storage of credentials. The attack may be initiated remotely. The exploit ha...
CVE-2023-4984
CVE-2023-4984 affects didi KnowSearch versions 0.3.2 and 0.3.1.2. The root issue is processing in the API endpoint "/api/es/admin/v3/security/user/1" that leads to unprotected storage of credentials. The vulnerability can be triggered remotely, and the exploit has been disclosed publicly. Affecte...
DiDi KnowSearch Security Breach
DiDi KnowSearch is a zero-intrusion, multi-tenant Elasticsearch GUI control platform built around clustering and indexing for Elasticsearch R&D and O&M staff at China's DiDi. A security vulnerability exists in didi KnowSearch versions 0.3.2 and 0.3.1.2, which stems from certain unknown processing...
WordPress HTTP Auth Plugin <= 0.3.2 is vulnerable to Cross Site Request Forgery (CSRF)
Software HTTP Auth Type Plugin Vulnerable versions = 0.3.2 Fixed in 1.0.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27435 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 3c605b41c95d Credits Mika Required privilege...
WordPress Mail Control Plugin <= 0.3.1 is vulnerable to Cross Site Scripting (XSS)
Software Mail Control Type Plugin Vulnerable versions = 0.3.1 Fixed in 0.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3158 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 0eca928a8cff Credits Alex Thomas Required...
PT-2023-11540 · Unknown · Cryptoprof Wcms
Name of the Vulnerable Software and Affected Versions: Cryptoprof WCMS version 0.3.2 Description: A Directory Traversal issue allows a remote attacker to execute arbitrary code via the wex/cssjs.php parameter. Recommendations: For Cryptoprof WCMS version 0.3.2, consider restricting access to the...
WCMS 路径遍历漏洞
WCMS is a content management system CMS. A security vulnerability exists in WCMS version v.0.3.2. An attacker can exploit the vulnerability to execute arbitrary code via the wex/cssjs.php parameter...
CVE-2023-31689
In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter. It can write arbitrary strings into custom file names and upload any files, and write malicious code to execute script...
Command injection
In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter. It can write arbitrary strings into custom file names and upload any files, and write malicious code to execute script...
CVE-2023-31689
CVE-2023-31689 affects WCMS 0.3.2. Affected endpoint: /wcms/wex/html.php where an attacker, using the finish and textAreaCode parameters, can write arbitrary strings to custom file names, upload arbitrary files, and inject/execute malicious code leading to command execution. This is described con...
WCMS 代码问题漏洞
WCMS is a content management system CMS. A security vulnerability exists in WCMS version 0.3.2. An attacker can use this vulnerability to write arbitrary strings to custom file names and upload arbitrary files, or write malicious code to execute scripts to trigger command execution...
CVE-2023-31689
In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter. It can write arbitrary strings into custom file names and upload any files, and write malicious code to execute script...
PT-2023-23418 · Wcms · Wcms
Name of the Vulnerable Software and Affected Versions: Wcms version 0.3.2 Description: The issue allows an attacker to send a crafted request from a vulnerable web application backend server via the "finish" parameter and the textAreaCode parameter in the "/wcms/wex/html.php" endpoint. This enabl...
CVE-2023-31689
In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter. It can write arbitrary strings into custom file names and upload any files, and write malicious code to execute script...
[SECURITY] Fedora 38 Update: rust-sevctl-0.3.2-4.fc38
Administrative utility for AMD SEV...
PT-2023-21905 · Dino +2 · Dino +2
Name of the Vulnerable Software and Affected Versions: Dino versions prior to 0.2.3 Dino versions 0.3.x prior to 0.3.2 Dino versions 0.4.x prior to 0.4.2 Description: The issue allows attackers to modify the personal bookmark store via a crafted message. This can lead to changing the display of...
PT-2023-9863 · Unknown · Cfire24 Ajaxlife
Name of the Vulnerable Software and Affected Versions: cfire24 ajaxlife versions up to 0.3.2 Description: A vulnerability has been found in cfire24 ajaxlife, classified as problematic. The manipulation leads to cross site scripting. The attack can be initiated remotely. Recommendations: For cfire...
