197 matches found
WordPress plugin Tippy 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to clickjacking (CVE-2023-23482)
Summary IBM Sterling Partner Engagement Manager has addressed a vulnerability of missing X-Frame-Options Header which leads to Clickjacking. Vulnerability Details CVEID:CVE-2023-23482 DESCRIPTION: IBM Sterling Partner Engagement Manager could allow a remote attacker to hijack the clicking action ...
PT-2023-18983 · Ibm · Ibm Sterling Partner Engagement Manager
Name of the Vulnerable Software and Affected Versions: IBM Sterling Partner Engagement Manager versions 6.1 through 6.2.1 Description: The issue allows a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could...
Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to a denial of service due to Apache Commons FileUpload (CVE-2023-24998)
Summary There is a vulnerability in the Apache Commons FileUpload library used by IBM Sterling Partner Engagement Manager. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of...
Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to cross-site scripting (CVE-2023-23481)
Summary IBM Sterling Partner Engagement Manager has addressed a stored cross-site scripting vulnerability. Vulnerability Details CVEID:CVE-2023-23481 DESCRIPTION: IBM Sterling Partner Engagement Manager is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitra...
Fedora 38 : wordpress (2023-e18d3d4004)
The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-e18d3d4004 advisory. WordPress 6.2.2 Security Release Security updates included in this release: Block themes parsing shortcodes in user-generated data; thanks to Liam Gladdy of ...
WordPress Unspecified Vulnerability (May 2023) - Linux
WordPress is prone to an unspecified vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress";...
Acceptance of Extraneous Untrusted Data With Trusted Data
Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to Acceptance of Extraneous Untrusted Data With Trusted Data through the processing of shortcodes in user-generated content. An attacker can manipulate...
WordPress is vulnerable to Cross Site Request Forgery (CSRF)
Software WordPress Type WordPress Core Vulnerable versions = 6.2 Fixed in 6.2.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 472fe0253e33 Credits John Blackbourn Required...
WordPress 6.0 < 6.2.1
WordPress versions 6.0 6.2.1 are affected by one or more vulnerabilities %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from WordPress Security Advisory wordpress-6-2-1-maintenance-security-release. include'compat.inc'; if description...
WordPress is vulnerable to Cross Site Scripting (XSS)
Software WordPress Type WordPress Core Vulnerable versions = 6.2 Fixed in 6.2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3d96c6d7db81 Credits Jakub Zoczek Securitum Required...
CVE-2023-23709
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Denis WPJAM Basic plugin = 6.2.1 versions...
WordPress Tippy Plugin <= 6.2.1 is vulnerable to Cross Site Scripting (XSS)
Software Tippy Type Plugin Vulnerable versions = 6.2.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-31079 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3bd9b4cefb69 Credits Mika Required privilege Contributor...
SUSE CVE-2014-4471
WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in...
SUSE CVE-2014-4475
WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in...
CVE-2022-41564
The Hawk Console component of TIBCO Software Inc.'s TIBCO Hawk and TIBCO Operational Intelligence Hawk RedTail contains a vulnerability that will return the EMS transport password and EMS SSL password to a privileged user. Affected releases are TIBCO Software Inc.'s TIBCO Hawk: versions 6.1.0...
Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to remote code execution due to Apache Commons Text [CVE-2022-42889]
Summary IBM Sterling Partner Engagement Manager has addressed a Publicly disclosed vulnerability that are published by Apache Commons - Collections v3.2.1 CVE-2022-42889 Vulnerability Details CVEID:CVE-2022-42889 DESCRIPTION: Apache Commons Text could allow a remote attacker to execute arbitrary...
Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to spoofing attacks due to WAS Liberty (CVE-2018-25031, CVE-2021-46708)
Summary IBM Sterling Partner Engagement Manager has addressed all vulnerabilities published by WAS liberty below. Vulnerability Details CVEID:CVE-2018-25031 DESCRIPTION: swagger-ui could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a specially-crafted URL, a...
