CVE-2023-23804

Cross-Site Request Forgery CSRF vulnerability in HasThemes HT Feed plugin = 1.2.7 versions...

Wordpress Plugin HT Feed 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2023-19219 · Hasthemes · Ht Feed

Name of the Vulnerable Software and Affected Versions: HasThemes HT Feed plugin versions 1.2.7 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a we...

WordPress plugin Ninja Forms Google Sheet Connector 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

HPESBHF04473 rev.1 - SGI UV300 and HPE MC990 X Remote Management Controller (RMC), Local Multiple Vulnerabilities

Potential Security Impact: Local: Multiple Vulnerabilities SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Integrity MC990 X Server RMC firmware 1.2.7 or earlier SGI UV 300 RMC firmware 1.2.7 or earlier CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | |...

WordPress Plugin Brilliance 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2023-6579 · 10Web · Seo By 10Web Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: SEO by 10Web WordPress plugin versions prior to 1.2.7 Description: The issue is related to the SEO by 10Web WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as...

WordPress plugin WP Education 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2023-16309 · WordPress · Wp Education

Name of the Vulnerable Software and Affected Versions: WP Education WordPress plugin versions prior to 1.2.7 Description: The issue concerns a lack of CSRF check when activating plugins, which could allow attackers to make logged-in admins activate arbitrary plugins present on the blog via a CSRF...

K97521840: logback vulnerability CVE-2021-42550

Security Advisory Description In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers. CVE-2021-42550 Impact There is no impact; F5 products...

SUSE CVE-2011-4139

Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request...

Cross site scripting

A vulnerability has been found in Newcomer1989 TSN-Ranksystem up to 1.2.6 and classified as problematic. This vulnerability affects the function getlog of the file webinterface/bot.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.2....

WordPress Integration for Szamlazz.hu & Gravity Forms plugin <= 1.2.6 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities were discovered by Lana Code in WordPress Integration for Szamlazz.hu & Gravity Forms plugin versions = 1.2.6. Solution Update the WordPress Integration for Szamlazz.hu & Gravity Forms plugin to the latest available version at least 1.2.7...

GREYD.SUITE < 1.2.7 - Unauthenticated File Upload to RCE

The plugin does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible remote code execution RCE. Version 1.2.5 added CSRF checks Sen...

Security Bulletin: IBM DataPower Operator affected by flaw in Go (CVE-2022-23773)

Summary This is a build-time issue that does not affect product code, but may be flagged in customer scans. IBM has addressed the CVE. Vulnerability Details CVEID: CVE-2022-23773 DESCRIPTION: An unspecified error with not treating branches with semantic-version names as releases in cmd/go in Gola...

Security Bulletin: Flaw in Go may affect DataPower Operator (CVE-2021-44717)

Summary IBM has addressed the CVE Vulnerability Details CVEID: CVE-2021-44717 DESCRIPTION: Golang Go could allow a remote attacker to bypass security restrictions, caused by an error in the syscall.ForkExec interface. By causing the erroneous closing of file descriptor 0 after file-descriptor...

CVE-2022-29449

Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerability in Opal Hotel Room Booking plugin = 1.2.7 at WordPress...

Opal Hotel Room Booking <= 1.2.7 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape a parameter which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

Django Vulnerable to Cache Poisoning

Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request...

GHSA-RM2J-X595-Q9CJ Django Vulnerable to Cache Poisoning

Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request...