120 matches found
CVE-2023-1624
The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcodeactivatesnippets capability delete arbitrary log files on the server, including...
CVE-2023-1624
The WPCode WordPress plugin prior to version 2.0.9 is affected by a CSRF vulnerability in the log deletion function. The flaw does not properly verify that the target file is within the expected folder, allowing users with the wpcode_activate_snippets capability to delete arbitrary log files on t...
CVE-2023-1624 WPCode Lite < 2.0.9 - Arbitrary Log File Deletion via CSRF
The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcodeactivatesnippets capability delete arbitrary log files on the server, including...
CVE-2023-1624 WPCode Lite < 2.0.9 - Arbitrary Log File Deletion via CSRF
The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcodeactivatesnippets capability delete arbitrary log files on the server, including...
WordPress WPCode Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)
Software WPCode Type Plugin Vulnerable versions = 2.0.8 Fixed in 2.0.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-1624 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e3a7e2e0edf4 Credits Erwan LR Required privilege...
SUSE CVE-2010-1624
The msnemoticonmsg function in slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.7.0 allows remote authenticated users to cause a denial of service NULL pointer dereference and application crash via a custom emoticon in a malformed SLP message...
Cisco IOS XE Software Rate Limiting Network Address Translation DoS (cisco-sa-ratenat-pYVLA7wM)
According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. - A vulnerability in the Rate Limiting Network Address Translation NAT feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause high CPU utilization in the Cisco...
Cisco IOS XE Software Rate Limiting Network Address Translation DoS (cisco-sa-ratenat-pYVLA7wM) Unpatched Commands
According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. - A vulnerability in the Rate Limiting Network Address Translation NAT feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause high CPU utilization in the Cisco...
CVE-2022-1624
The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2022-1624 Latest Tweets Widget <= 1.1.4 - Arbitrary Settings Update via CSRF
The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2022-1624
Summary: CVE-2022-1624 affects the WordPress plugin Latest Tweets Widget (versions ≤ 1.1.4). The flaw is a missing CSRF check when updating settings, which could let a logged-in admin be manipulated via CSRF. Sources across NVD, Red Hat, CNVD, CVE List, WPVulnDB, CNNVD and PatchStack corroborate ...
CVE-2021-1624
Cisco IOS XE Software contains a vulnerability in the Rate Limiting NAT feature that can be exploited remotely by sending large volumes of traffic, causing the QuantumFlow Processor to reach 100% utilization and resulting in a DoS. Root cause: mishandling of the rate limiting feature within the Q...
SUSE: Security Advisory (SUSE-SU-2014:1624-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE: Security Advisory (SUSE-SU-2019:2719-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE: Security Advisory (SUSE-SU-2019:2719-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Amazon Linux 2 : wpa_supplicant (ALAS-2021-1624)
The version of wpasupplicant installed on the remote host is prior to 2.6-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1624 advisory. A flaw was found in the wpasupplicant, in the way it processes P2P Wi-Fi Direct provision discovery requests. This flaw allows...
CentOS 8 : php:7.2 (CESA-2020:1624)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1624 advisory. - php: Buffer over-read in PHAR reading functions CVE-2018-20783 - php: Heap buffer overflow in function exifprocessIFDTAG CVE-2019-11034 - php: Heap...
RHEL 8 : php:7.2 (RHSA-2020:1624)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1624 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have been upgraded to a later...
CVE-2020-1624
CVE-2020-1624 affects Junos OS Evolved prior to 19.1R1. A local, authenticated user can access raw objmon configuration files and obtain hashed values of login passwords and shared secrets, leaking sensitive information. The impact is confined to confidentiality of credentials via object monitori...