66 matches found
CVE-2023-4757
CVE-2023-4757 affects the WordPress plugin “Staff / Employee Business Directory for Active Directory” (LDAP/AD directory plugin) prior to version 1.2.3. The root cause is improper escaping of data returned from the LDAP server, allowing LDAP-controlled entries to inject malicious JavaScript when ...
WordPress Staff / Employee Business Directory for Active Directory Plugin < 1.2.3 is vulnerable to Broken Access Control
Software Staff / Employee Business Directory for Active Directory Type Plugin Vulnerable versions 1.2.3 Fixed in 1.2.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-4757 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 41d386a4513c...
CVE-2022-4757
CVE-2022-4757 affects the List Pages Shortcode WordPress plugin (versions before 1.7.6). The issue arises because the plugin does not validate and escape certain shortcode attributes before output, enabling Stored XSS from a contributor-level user to target higher-privilege admins. Multiple conne...
CVE-2022-4757 List Pages Shortcode < 1.7.6 - Contributor+ Stored XSS via Shortcode
The List Pages Shortcode WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...
CVE-2019-4757
IBM InfoSphere Information Server is vulnerable to cross-site request forgery (CSRF) under CVE-2019-4757. Affected products/versions include IBM InfoSphere Information Server (11.3, 11.5, 11.7) and InfoSphere Information Server on Cloud (11.5, 11.7). The bulletin lists remediation patches and ser...
SUSE CVE-2015-4757
Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier and 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer...
MariaDB 10.0.0 < 10.0.18 Multiple Vulnerabilities
The version of MariaDB installed on the remote host is prior to 10.0.18. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.0.18 advisory. - The compilebranch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of...
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : wpa_supplicant and hostapd vulnerability (USN-4757-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4757-1 advisory. It was discovered that wpasupplicant did not properly handle P2P Wi-Fi Direct provision discovery requests in some situations. A physicall...
CVE-2020-4757
CVE-2020-4757 affects IBM FileNet Content Manager and IBM Content Navigator 3.0.CD with a stored cross-site scripting vulnerability in the Web UI. The root cause is an XSS flaw in the Content Navigator/Content Manager web interface that could allow an attacker to embed arbitrary JavaScript, poten...
Debian: Security Advisory (DSA-4757-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Security Bulletin: IBM InfoSphere Information Server is vulnerable to Cross-site request forgery (CVE-2019-4407 CVE-2019-4757)
Summary A Cross-site request forgery vulnerability was addressed by IBM InfoSphere Information Server. Vulnerability Details CVEID: CVE-2019-4407 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and...
Man-in-the-Middle Attack
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. It was found that the MySQL client library permitted but did not require a client to use SSL/TLS when establishing a secure connection to a MySQL server using the "--ssl" option. A man-in-the-middle...
Denial Of Service (DoS)
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update...
Denial Of Service (DoS)
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update...
Denial Of Service (DoS)
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update...
Denial Of Service (DoS)
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update...
Denial Of Service (DoS)
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update...
