Rock Convert < 2.6.0 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape an URL before outputting it back in an attribute when a specific widget is present on a page, leading to a Reflected Cross-Site Scripting PoC On a page where the "Capture box | Rock Convert" widget is present, append ?", e.g: https://example.com/?"...

WordPress Redirection for Contact Form 7 plugin <= 2.4.0 - Unauthenticated Options Change and Content Injection vulnerability

Unauthenticated Options Change vulnerability discovered by mirphak Patchstack Alliance in WordPress Redirection for Contact Form 7 plugin versions = 2.4.0. Successful exploitation requires an additional extension plugin AccessiBe. An attacker can inject a script into the footer. Solution Update t...

CVE-2022-2633

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the /public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensiti...

CVE-2022-2633

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the /public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensiti...

PT-2022-17789 · WordPress · All-In-One Video Gallery

Name of the Vulnerable Software and Affected Versions: All-in-One Video Gallery plugin for WordPress versions up to, and including 2.6.0 Description: The issue allows unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server via the dl...

DEBIAN-CVE-2022-3008

The tinygltf library uses the C library function wordexp to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. W...

Command injection

The tinygltf library uses the C library function wordexp to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. W...

CVE-2022-3008 Command Injection on tinygltf

The tinygltf library uses the C library function wordexp to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. W...

CVE-2022-1021

Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0...

Information disclosure

Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0...

chatwoot 跨站脚本漏洞

chatwoot is a software application. Customer Engagement Suite, an open source alternative to Intercom, Zendesk, Salesforce Service Cloud and more. A cross-site scripting vulnerability exists in versions prior to chatwoot 2.6.0 that stems from insecure storage of sensitive information...

PT-2022-13596 · Chatwoot · Chatwoot

Name of the Vulnerable Software and Affected Versions: chatwoot/chatwoot versions prior to 2.6.0 Description: The issue concerns insecure storage of sensitive information in the GitHub repository chatwoot/chatwoot. Recommendations: For versions prior to 2.6.0, update to version 2.6.0 or later to...

CVE-2022-33969

Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin = 2.6.0 at WordPress...

WordPress plugin Flipbox 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2022-21939 · Biplob Adhikari · Flipbox

Name of the Vulnerable Software and Affected Versions: Biplob Adhikari's Flipbox plugin versions = 2.6.0 Description: The issue concerns an authenticated WordPress options change vulnerability. It is related to Biplob Adhikari's Flipbox plugin at WordPress. Recommendations: For Biplob Adhikari's...

[SECURITY] Fedora 36 Update: golang-gopkg-square-jose-2-2.6.0-3.fc36

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. This includes support for JSON Web Encryption, JSON Web Signature, and JSON Web Token standards...

openSUSE 15 Security Update : tensorflow2 (openSUSE-SU-2022:10014-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10014-1 advisory. Update to TF2 2.6.0 which fixes multiple CVEs boo1189423. - Introduction of bazel6.3 and basel-skylib1.0.3 as build dependencies. The latter has...

Chat Server 输入验证错误漏洞

Chat Server is ramank775 individual developer's chat server based on microservices architecture, supporting high availability, high throughput, and horizontal scaling. An input validation error vulnerability exists in Chat Server versions 2.3.2 through 2.6.0, which stems from the application havi...

GHSA-X78V-4FVJ-RG9J Camaleon CMS Stored Cross-site Scripting vulnerability

In “Camaleon CMS” application, versions 0.0.1 through 2.6.0 are vulnerable to stored XSS, that allows unprivileged application users to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious...

Camaleon CMS Insufficient Session Expiration vulnerability

Camaleon CMS 0.1.7 through 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed. Resolved in commit...