CVE-2023-4395

Cockpit XSS vulnerability (CVE-2023-4395) affects cockpit-hq/cockpit prior to version 2.6.4. The issue is a Stored XSS in the web UI, caused by input not being properly escaped in templates, allowing an authenticated attacker to inject JavaScript into Cockpit pages (Veracode description). Public ...

CVE-2023-4395 Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

Cross-site Scripting XSS - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4...

CVE-2021-4395

The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the getitems and extratablenav functions. This makes it possible for unauthenticated...

CVE-2021-4395

The CVE-2021-4395 entry concerns the WordPress plugin “Abandoned Cart Recovery for WooCommerce.” The vulnerability is a Cross-Site Request Forgery (CSRF) affecting versions up to and including 1.0.4, caused by missing or incorrect nonce validation in the get_items() and extra_tablenav() functions...

CVE-2021-4395 Abandoned Cart Recovery for WooCommerce <= 1.0.4 - Cross-Site Request Forgery Bypass

The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the getitems and extratablenav functions. This makes it possible for unauthenticated...

CVE-2022-4395 Membership For WooCommerce < 2.1.7 - Unauthenticated Arbitrary File Upload

The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious PHP code, and achieve RCE...

CVE-2022-4395 Membership For WooCommerce < 2.1.7 - Unauthenticated Arbitrary File Upload

The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious PHP code, and achieve RCE...

CVE-2022-4395

The CVE-2022-4395 entry describes a vulnerability in the WordPress plugin “Membership For WooCommerce” prior to version 2.1.7 where uploaded files are not validated, allowing unauthenticated users to upload arbitrary files (e.g., PHP), enabling remote code execution. Affected software: Membership...

WordPress Membership For WooCommerce Plugin < 2.1.7 is vulnerable to Arbitrary File Upload

Software Membership For WooCommerce Type Plugin Vulnerable versions 2.1.7 Fixed in 2.1.7 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Upload CVE CVE-2022-4395 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 0a53b711b376 Credits cydave Required...

CVE-2020-4395

creationtimestamp| type| source ---|---|--- 2020-10-14 20:51:12+00:00| seen| https://t.me/cibsecurity/15267...

CVE-2020-4395

IBM Security Access Manager Appliance 9.0.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 179358...

CVE-2020-4395

IBM Security Access Manager Appliance 9.0.7 is vulnerable because it does not invalidate sessions after logout, potentially allowing an authenticated user to impersonate another user. Connected sources confirm a fix in 9.0.7.2 (fix pack: 9.0.7-ISS-ISAM-FP0002) and related updates for ISAM in Dock...

Security Bulletin: Security Vulnerabilities have been fixed in IBM Security Access Manager

Summary Fixes for security vulnerabilities are available for the IBM Security Access Manager product. Vulnerability Details CVEID: CVE-2020-4395 DESCRIPTION: IBM Security Access Manager does not invalidate session after logout which could allow an authenticated user to impersonate another user on...

CVE-2013-4395

CVE-2013-4395 affects Simple Machines Forum (SMF) up to version 2.0.5, with a cross-site scripting (XSS) vulnerability. The connected records confirm the product and vulnerability class but do not provide technical details such as vulnerable components, exploit vectors, affected configurations, r...

CVE-2019-4395

IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a local user to obtain sensitive information from temporary script files. IBM X-Force ID: 162333...

CVE-2019-4395

CVE-2019-4395 affects IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. The vulnerability enables a local attacker to obtain sensitive information from temporary script files. Affected versions include IBM Cloud Orchestrator/Enterprise 2.4, 2.4.0.1–2.4.0.5, and 2.5, 2.5.0.1–2.5.0.9. I...

Security Bulletin: IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise Edition is affected by ASoC vulnerability (CVE-2019-4395)

Summary IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise has addressed the ASoC vulnerability. Vulnerability Details CVEID: CVE-2019-4395 DESCRIPTION: IBM Cloud Orchestrator could allow a local user to obtain sensitive information from temporary script files. CVSS Base Score: 4 CVSS...

CVE-2018-4395

This issue was addressed with improved checks. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5...

CVE-2018-4395

CVE-2018-4395 affects Apple ecosystems (iOS before 12, macOS Mojave 10.14 before patch, tvOS 12, watchOS 5). The issue was addressed with improved checks; impact per CVE indicates local attack vector with partial availability impact and, in CVSSv3, a medium severity (5.5) with high impact on avai...

Debian DSA-4395-1 : chromium - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2018-17481 A use-after-free issue was discovered in the pdfium library. - CVE-2019-5754 Klzgrad discovered an error in the QUIC networking implementation. - CVE-2019-5755 Jay Bosamiya discovered an implementation erro...