374 matches found
GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin
ADVISORY INFORMATION Exploit Title: GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin Date of found: 11 Jun 2022 Application: GLPI Manageentities 4.0.2 Author: Nuri Çilengir Vendor Homepage: https://glpi-project.org/ Software Link:...
Cross site scripting
Auth. subscriber+ Stored Cross-Site Scripting XSS vulnerability in MainWP MainWP Code Snippets Extension plugin = 4.0.2 versions...
CVE-2023-0273 Custom Content Shortcode <= 4.0.2 - Contributor+ Stored XSS
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...
WordPress plugin Custom Content Shortcode 路径遍历漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A path traversal vulnerability exists in WordPress...
CVE-2023-0069 WPaudio MP3 Player <= 4.0.2 - Contributor+ Stored XSS
The WPaudio MP3 Player WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-26091
The frpformanswers aka Forms Export extension before 3.1.2, and 4.x before 4.0.2, for TYPO3 allows XSS via saved emails...
PT-2023-20480 · Unknown · Frp Form Answers
Name of the Vulnerable Software and Affected Versions: frp form answers extension versions prior to 3.1.2 frp form answers extension versions 4.x prior to 4.0.2 Description: The issue allows XSS via saved emails. Recommendations: For frp form answers extension versions prior to 3.1.2, update to...
TYPO3 跨站脚本漏洞
TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland. A security vulnerability exists in TYPO3 versions prior to 3.1.2 and 4.x versions prior to 4.0.2, which stems from allowing XSS attacks via saved emails...
GHSA-54Q4-74P3-MGCW rttys SQL Injection vulnerability
SQL Injection vulnerability in rttys versions 4.0.0, 4.0.1, and 4.0.2 in api.go, allows attackers to execute arbitrary code...
SUSE CVE-2005-2006
JBOSS 3.2.2 through 3.2.7 and 4.0.2 allows remote attackers to obtain sensitive information via a GET request 1 with a "%." percent dot, which reveals the installation path or 2 with a % percent before a filename, which reveals the contents of the file...
SUSE CVE-2018-1112
glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression...
SUSE CVE-2020-24996
There is an invalid memory access in the function TextString::TextString located in Catalog.cc in Xpdf 4.0.2. It can be triggered by for example sending a crafted pdf file to the pdftohtml binary, which allows a remote attacker to cause a Denial of Service Segmentation fault or possibly have...
SUSE CVE-2020-24999
There is an invalid memory access in the function fprintf located in Error.cc in Xpdf 4.0.2. It can be triggered by sending a crafted PDF file to the pdftohtml binary, which allows a remote attacker to cause a Denial of Service Segmentation fault or possibly have unspecified other impact...
SUSE CVE-2023-0417
Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file...
rttys SQL注入漏洞
rttys is an application by the personal developer Jianhui Zhao. The device's endpoint is accessed from anywhere over the network. A SQL injection vulnerability exists in rttys version 4.0.0, 4.0.1, and 4.0.2. The vulnerability stems from the presence of a SQL injection vulnerability that can be...
PT-2023-16115 · WordPress · Enable Media Replace
Name of the Vulnerable Software and Affected Versions: Enable Media Replace WordPress plugin versions prior to 4.0.2 Description: The issue allows authors to upload arbitrary files to the site, potentially enabling them to upload PHP shells on affected sites. Recommendations: For Enable Media...
WordPress plugin Enable Media Replace 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...
CVE-2023-0416
GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file...