36 matches found
CVE-2022-47196
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this...
CVE-2022-47196
CVE-2022-47196 affects Ghost Foundation Ghost 5.9.4. A stored XSS vulnerability exists in the post creation feature: non-administrator users can inject arbitrary JavaScript via the post’s codeinjection_head, potentially escalating privileges to administrator when an admin views the post. The issu...
CVE-2022-47194
CVE-2022-47194 affects Ghost Foundation Ghost 5.9.4. A stored XSS flaw exists in the Post Creation workflow and in the user’s twitter field, enabling non-administrator users to inject JavaScript into posts which can escalate to administrator privileges when the affected post is viewed. Exploitati...
CVE-2022-47194
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this...
PT-2023-15233 · Ghost · Ghost
Name of the Vulnerable Software and Affected Versions: Ghost versions 5.9.4 Description: An insecure default issue exists in the Post Creation functionality, allowing non-administrator users to inject arbitrary Javascript in posts. This enables privilege escalation to administrator via XSS. An...
PT-2023-15235 · Ghost Foundation · Ghost
Name of the Vulnerable Software and Affected Versions: Ghost Foundation Ghost version 5.9.4 Description: An insecure default vulnerability exists in the Post Creation functionality, allowing non-administrator users to inject arbitrary Javascript in posts. This enables privilege escalation to...
CVE-2022-41697
CVE-2022-41697 affects Ghost CMS 5.9.4, where the login flow returns distinct error messages that allow attacker-driven user enumeration. The Nuclei template and related sources confirm a vulnerability in Ghost’s authentication, enabling an attacker to determine valid usernames/emails via special...
CVE-2022-41654
CVE-2022-41654 affects Ghost Foundation Ghost 5.9.4. Cisco Talos details an authentication bypass in the newsletter subscription feature, enabling an unauthenticated or minimal-auth attacker to manipulate newsletters via the /members/api/member/ endpoint, potentially creating or modifying newslet...
CVE-2022-41697
A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigger this vulnerability...
OESA-2021-1408 strongswan security update
The strongSwan IPsec implementation supports both the IKEv1 and IKEv2 key exchange protocols in conjunction with the native NETKEY IPsec stack of the Linux kernel. Security Fixes: The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS...
ALPINE-CVE-2021-41990
The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example, this can be triggered by an unrelated self-signed CA certificate sent by an initiator. Remote code execution cannot occur...
strongSwan 输入验证错误漏洞
strongSwan is a Swiss Andreas Steffen personal developer of a Linux platform to use the open source IPsec-based VPN solution. The solution includes authentication mechanisms such as X.509 public key certificates, secure storage of private keys, and smart cards. An input validation error...
strongSwan 输入验证错误漏洞
strongSwan is a Swiss Andreas Steffen personal developer of a Linux platform to use the open source IPsec-based VPN solution. The solution includes authentication mechanisms such as X.509 public key certificates, securely stored private keys, and smart cards. An input validation error vulnerabili...
PT-2019-8926 · WordPress · Events Manager
Name of the Vulnerable Software and Affected Versions: Events Manager plugin version 5.9.4 Description: The issue concerns a cross-site scripting XSS problem. It is exploited via the dbem event reapproved email body parameter to the "wp-admin/edit.php?post type=event&page=events-manager-options"...
WinSCP 5.9.4 - LIST Denial of Service Exploit
Exploit for windows platform in category dos / poc Exploit Title: WinSCP 5.9.4 - LIST Command Denial of service Crush application Date: 4-4-2017 mm.dd.yy Exploit Author: M.Ibrahim email protected E-Mail: vulnbug gmail.com Vendor Home Page: https://winscp.net/eng/index.php Vendor download link:...
