Cross site scripting

The "WebSub FKA. PubSubHubbub" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2023-49099

Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4...

CVE-2023-48297

Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions @all and @here which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5...

CVE-2023-49099 Discourse secure uploads accessible to guests even when login is required

Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4...

CVE-2023-48297 Discourse vulnerable to unlimited mentioned users in message serializer

Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions @all and @here which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5...

PT-2024-13578 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.4 Discourse version beta 3.2.0.beta5 and earlier Description: Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions @all and @here, which can lead...

CVE-2023-49752

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Spoon themes Adifier - Classified Ads WordPress Theme.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4...

PT-2023-31104 · WordPress · Adifier

Name of the Vulnerable Software and Affected Versions: Adifier - Classified Ads WordPress Theme versions prior to 3.1.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that...

WordPress JetFormBuilder Plugin <= 3.1.4 is vulnerable to Content Injection

Software JetFormBuilder Type Plugin Vulnerable versions = 3.1.4 Fixed in 3.1.5 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2023-48763 Patch priority Low CVSS severity Low 5.3 Developer Crocoblock PSID fd2d4da6e79b Credits Revan Arifio Required privilege Unauthenticated...

OpenSSL Incorrect Cipher Key & IV Length Processing Vulnerability (20231024) - Linux

OpenSSL is prone to an incorrect processing of key and initialisation vector IV lengths vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2023-5109

The WP Mailto Links – Protect Email Addresses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wpmlmailto' shortcode in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Cross site scripting

The WP Mailto Links – Protect Email Addresses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wpmlmailto' shortcode in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-45748 WordPress MailChimp Forms by MailMunch Plugin <= 3.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in MailMunch MailChimp Forms by MailMunch plugin = 3.1.4 versions...

PT-2023-29664 · Mailmunch · Mailchimp Forms By Mailmunch

Name of the Vulnerable Software and Affected Versions: MailMunch MailChimp Forms by MailMunch plugin versions = 3.1.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

Malicious code in @hnbi/searchfeuikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc2a084aa0cb1894201a316f58f41e4ec30f5b5cb2e4d0fbe2d514c544064de4 The OpenSSF Package Analysis project identified '@hnbi/searchfeuikit' @ 3.1.4 npm as malicious. It is considered malicious because: - The packag...

WordPress Intuitive Custom Post Order Plugin < 3.1.4 Multiple Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:intuitivecustompostorderproject:intuitivecustompostorder";...

DEBIAN-CVE-2023-35936

Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Starting in version 1.13 and prior to version 3.1.4, Pandoc is susceptible to an arbitrary file write vulnerability, which can be triggered by providing a specially crafte...

Pandoc 输入验证错误漏洞

Pandoc is a Haskell library for converting from one markup format to another, as well as command line tools that use the library. An input validation error vulnerability exists in Pandoc versions 1.13 through prior to 3.1.4, which stems from vulnerability to an arbitrary file write vulnerability...

PT-2023-9554

Name of the Vulnerable Software and Affected Versions Pandoc versions 1.13 through 3.1.4 Description Pandoc is susceptible to an arbitrary file write vulnerability, which can be triggered by providing a specially crafted image element in the input when generating files using the --extract-media...

CVE-2023-22795 affecting package ruby for versions less than 3.1.4-1

CVE-2023-22795 affecting package ruby for versions less than 3.1.4-1. An upgraded version of the package is available that resolves this issue...