PT-2023-20315 · Tutor Lms · Tutor Lms

Name of the Vulnerable Software and Affected Versions: Tutor LMS versions n/a through 2.2.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

Cross site scripting

The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change...

WordPress Plugin WP Meta and Date Remover Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Duplicate Advisory: NATS.io: Adding accounts for just the system account adds auth bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fr2g-9hjm-wr23. This link is maintained to preserve external references. Original Description NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an...

CVE-2023-47090

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is...

AZL-35301 CVE-2023-47090 affecting package telegraf for versions less than 1.29.4-1

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is...

DEBIAN-CVE-2023-47090

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is...

CVE-2023-47090

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is...

CVE-2023-47090

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is...

CVE-2023-47090

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is...

PT-2023-29762 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzzcms version 2.2.0 Description: The issue is related to an open redirect vulnerability. Recommendations: For zzzcms version 2.2.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability...

PT-2023-29331 · Cytech · Cytech Buddymeet Plugin

Name of the Vulnerable Software and Affected Versions: Cytech BuddyMeet plugin versions = 2.2.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, which can then be execute...

CVE-2023-5582

A vulnerability, which was classified as problematic, has been found in ZZZCMS 2.2.0. This issue affects some unknown processing of the component Personal Profile Page. The manipulation leads to basic cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to th...

CVE-2023-5582

CVE-2023-5582 concerns ZZZCMS 2.2.0, where the Personal Profile Page’s processing permits basic cross-site scripting due to an unspecified handling flaw. Multiple connected documents consistently describe an XSS vulnerability that can be triggered remotely and for which exploits have been publicl...

CVE-2022-22298

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiIsolator version 1.0.0, FortiIsolator version 1.1.0, FortiIsolator version 1.2.0 through 1.2.2, FortiIsolator version 2.0.0 through 2.0.1, FortiIsolator version 2.1.0 through 2.1.2,...

PT-2023-12941 · Nats · Nats Nats-Server

Name of the Vulnerable Software and Affected Versions: NATS nats-server versions 2.2.0 through 2.7.4 Description: The issue allows directory traversal due to an unintended path to a management action from a management account. This is caused by an unintended path in the management account of the...

CVE-2023-28535

CVE-2023-28535: WordPress Paytm Donation Plugin ≤2.2.0 is vulnerable to unauthenticated reflected Cross-Site Scripting (XSS). The issue arises in Paytm Paytm Payment Donation plugin and is publicly tracked; Patchstack notes a fix in version 2.2.1. If not updated, affected deployments could allow ...

CUPS 2.2.0 < 2.4.6 Use After Free Vulnerability

CUPS is prone to an use after free vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openprinting:cups"; if...

WordPress plugin Contact Form Builder by Bit Form Cross Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

GHSA-JP5R-4X9Q-4VCF xuxueli xxl-job Cross-Site Request Forgery Vulnerability

Cross Site Request Forgery CSRF vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0 allows remote attackers to execute arbitrary code and esclate privileges via crafted .html file...