CVE-2023-38398

Cross-Site Request Forgery CSRF vulnerability in Taboola plugin = 2.0.1 versions...

CVE-2023-38398

Cross-Site Request Forgery CSRF vulnerability in Taboola plugin = 2.0.1 versions...

DEBIAN-CVE-2023-43646

get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service redos vulnerability which may lead to a denial of service when parsing malicious input. This vulnerabilit...

UBUNTU-CVE-2023-43646

get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service redos vulnerability which may lead to a denial of service when parsing malicious input. This vulnerabilit...

PT-2023-28897 · Unknown +1 · Get-Func-Name +1

Name of the Vulnerable Software and Affected Versions: get-func-name versions prior to 2.0.1 Description: The issue is related to a regular expression denial of service redos vulnerability in the get-func-name module, which can lead to a denial of service when parsing malicious input. This...

CVE-2023-42457

plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less...

PT-2023-6514 · Unknown · Plone.Rest

Name of the Vulnerable Software and Affected Versions: plone.rest versions 2.0.0 through 2.0.1 plone.rest versions 3.0.0 through 3.0.1 Description: The issue is related to the ++api++ traverser in plone.rest, which allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. When...

PT-2023-26655 · Unknown · Php-Login-System

Name of the Vulnerable Software and Affected Versions: PHP-Login-System version 2.0.1 Description: A reflected cross-site scripting XSS issue allows remote attackers to execute arbitrary JavaScript in a user's web browser. This is achieved by including a malicious payload into the selector...

PT-2023-26654

Name of the Vulnerable Software and Affected Versions msaad1999's PHP-Login-System version 2.0.1 Description A reflected cross-site scripting XSS issue allows remote attackers to execute arbitrary JavaScript in the web browser of a user. This is achieved by including a malicious payload into the...

CVE-2023-38876

CVE-2023-38876 describes a reflected XSS in msaad1999’s PHP-Login-System 2.0.1. The vulnerability is triggered by a malicious payload in the selector parameter of the /reset-password endpoint, allowing remote attackers to execute arbitrary JavaScript in a user’s browser. The available sources con...

CVE-2023-38876

A reflected cross-site scripting XSS vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'selector' parameter in '/reset-password'...

CVE-2023-40007

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ujwol Bastakoti CT Commerce plugin = 2.0.1 versions...

CVE-2023-40007

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ujwol Bastakoti CT Commerce plugin = 2.0.1 versions...

CVE-2023-36100

An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter in api/User/ChangeUser...

CVE-2023-36100

CVE-2023-36100 affects IceCMS 2.0.1. The issue is a privilege escalation and information disclosure via the UserID parameter in the endpoint api/User/ChangeUser. Root cause details are not fully disclosed in the provided documents, but multiple sources confirm the vulnerability in this specific v...

PT-2023-25429 · Icecms · Icecms

Name of the Vulnerable Software and Affected Versions: IceCMS version 2.0.1 Description: An issue was discovered in IceCMS, allowing attackers to escalate privileges and gain sensitive information via the UserID parameter in the "api/User/ChangeUser" endpoint. Recommendations: For IceCMS version...

SUSE CVE-2023-40587

Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of t...

CVE-2023-40587

Pyramid (Python web framework) versions 2.0.0–2.0.1 are affected by a directory-traversal vulnerability in a Pyramid static view that can disclose index.html located one directory above the static view path when accessed with Python 3.11. The issue stems from os.path.normpath behavior and affects...

CVE-2023-40587 Pyramid static view path traversal up one directory

Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of t...

Pyramid 路径遍历漏洞

Pyramid is a python based web framework. A path traversal vulnerability exists in Pyramid version 2.0.0 and 2.0.1, which stems from the presence of a path traversal vulnerability that can lead to easy disclosure of the file index.html...