1556 matches found
CVE-2023-27621
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in MrDemonWolf Livestream Notice plugin = 1.2.0 versions...
PT-2023-21260 · Unknown · Mrdemonwolf Livestream Notice
Name of the Vulnerable Software and Affected Versions: MrDemonWolf Livestream Notice plugin versions 1.2.0 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the MrDemonWo...
CVE-2023-32498
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Easy Form team Easy Form by AYS plugin = 1.2.0 versions...
PT-2023-23832 · Ays · Easy Form
Name of the Vulnerable Software and Affected Versions: Easy Form team Easy Form by AYS plugin versions 1.2.0 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions 1.2.0 an...
WordPress plugin Easy Form by AYS 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
CVE-2023-30875
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in All My Web Needs Logo Scheduler plugin = 1.2.0 versions...
WordPress plugin Logo Scheduler 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
WordPress Custom Admin Login Page | WPZest Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)
Software Custom Admin Login Page | WPZest Type Plugin Vulnerable versions = 1.2.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-40329 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1213e411287f Credits Lokesh...
AZL-34907 CVE-2023-3978 affecting package kubevirt for versions less than 1.2.0-1
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...
Deserialization vulnerability in Helix workflow and REST
An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run...
GHSA-JHCR-HPH9-G7WM Deserialization vulnerability in Helix workflow and REST
An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run...
Deserialization of untrusted data
An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run...
CVE-2023-38647 Apache Helix: Deserialization vulnerability in Helix workflow and REST
An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run...
CVE-2023-38647 Apache Helix: Deserialization vulnerability in Helix workflow and REST
An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run...
Design/Logic Flaw
Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users but an attacker could possibly craft ...
CVE-2023-38496 Apptainer's ineffective privileges drop when requesting container network
Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users but an attacker could possibly craft ...
Ineffective privileges drop when requesting container network
Impact Fix https://github.com/apptainer/apptainer/pull/1523 included in Apptainer 1.2.0-rc.2 has introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges. The attack surface is rather limited for users but an...
Apptainer 安全漏洞
Apptainer is a Linux open source container platform from Apptainer Open Source. A security vulnerability exists in Apptainer version 1.2.0-rc.2, which stems from the introduction of an invalid privilege drop when requesting container network settings, resulting in subsequent functions being calle...
PT-2023-26477 · Apptainer · Apptainer
Name of the Vulnerable Software and Affected Versions: Apptainer versions 1.2.0-rc.2 through 1.2.0 Description: Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are...