Typo3 Arbitrary file upload and XML External Entity processing

It has been discovered that Flow 3.0.0 allows arbitrary file uploads, inlcuding server-side scripts, posing the risk of attacks. If those scripts are executed by the server when accessed through their public URL, anything not blocked through other means is possible information disclosure, placeme...

GHSA-2P4F-VC9Q-R5VP Typo3 Arbitrary file upload and XML External Entity processing

It has been discovered that Flow 3.0.0 allows arbitrary file uploads, inlcuding server-side scripts, posing the risk of attacks. If those scripts are executed by the server when accessed through their public URL, anything not blocked through other means is possible information disclosure, placeme...

PT-2024-24423 · Freshworks · Freshdesk

Name of the Vulnerable Software and Affected Versions: Freshdesk versions through 2.3.6 Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability. This vulnerability affects Freshworks Freshdesk, allowing redirection to untrusted site...

Hacklog Down As PDF <= 2.3.6 - Reflected Cross-Site Scripting

Description The Hacklog Down As PDF plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

Moderate: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.4 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2023-49837

Uncontrolled Resource Consumption vulnerability in David Artiss Code Embed.This issue affects Code Embed: from n/a through 2.3.6...

CVE-2023-49837

A vulnerability in David Artiss Code Embed simple-embed-code.This issue affects Code Embed: from n/a through = 2.3.6...

BIT-MAGENTO-2021-28585 Magento Commerce improper input validation in customer customer webapi

Magento versions 2.4.2 and earlier, 2.4.1 and earlier and 2.3.6 and earlier are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails...

PT-2024-20605 · Unknown · Five Star Restaurant Reviews

Name of the Vulnerable Software and Affected Versions: Five Star Restaurant Reviews versions prior to 2.3.6 Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means an attacker can inject malicious...

PT-2024-14858 · WordPress · Eazydocs

Name of the Vulnerable Software and Affected Versions: EazyDocs WordPress plugin versions prior to 2.3.6 Description: The issue allows unauthenticated users to delete arbitrary posts, as well as add and delete documents/sections, due to the lack of authorization and CSRF checks when handling...

WordPress Plugin EazyDocs Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress Code Embed Plugin <= 2.3.6 is vulnerable to Denial of Service Attack

Software Code Embed Type Plugin Vulnerable versions = 2.3.6 Fixed in 2.3.7 OWASP Top 10 A4: Insecure Design Classification Denial of Service Attack CVE CVE-2023-49837 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 64a9010e7ee7 Credits Universe Required privilege Contribut...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in GloriaFood Restaurant Menu – Food Ordering System – Table Reservation plugin = 2.3.6 versions...

WordPress plugin Restaurant Menu – Food Ordering System – Table Reservation 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Restaurant Menu - Food...

DEBIAN-CVE-2021-32850

jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6...

UBUNTU-CVE-2021-32850

jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6...

PT-2023-12182 · Unknown +1 · Jquery Minicolors +1

Name of the Vulnerable Software and Affected Versions: jQuery MiniColors versions prior to 2.3.6 Description: The issue is related to cross-site scripting when handling untrusted color names. This can be exploited due to the lack of proper input validation in jQuery MiniColors. Recommendations: F...

jQuery MiniColors 跨站脚本漏洞

jQuery MiniColors is a small jQuery-based color picker from the individual developer Cory LaViska. A security vulnerability exists in jQuery MiniColors versions prior to 2.3.6, which stems from a cross-site scripting vulnerability that is prone to occur when handling untrusted color names...

SUSE CVE-2022-34903

GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints e.g., use of GPGME are met, allows signature forgery via injection into the status line...

CVE-2022-4657 Restaurant Menu < 2.3.6 - Contributor+ Stored XSS via Shortcode

The Restaurant Menu WordPress plugin before 2.3.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...