WordPress plugin view-all-posts-pages 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Frauscher Sensortechnik GmbH FDS001 路径遍历漏洞

Frauscher Sensortechnik GmbH FDS001 is a diagnostic system device from Frauscher. A path traversal vulnerability exists in Frauscher Sensortechnik GmbH FDS001 version 1.3.3 and earlier, which stems from the presence of a path traversal vulnerability. An attacker can exploit this vulnerability to...

Nextcloud: Nextcloud All-In-One path disclosure of internal frontend

Vulnerability description not provided...

PT-2023-20514 · Flatnest · Flatnest

Name of the Vulnerable Software and Affected Versions: flatnest versions all Description: The issue concerns Prototype Pollution via the nest function in the flatnest/nest.js file. This affects all versions of the package flatnest. Recommendations: For all versions, consider disabling the nest...

MOVEit transfer critical vulnerability

The Progress Community team released a security advisory and fixes for one critical severity security issue affecting all MOVEit Transfer versions. The issue was assigned CVE-2023-34362. Acronis security team concluded that Acronis infrastructure and products are not affected by this vulnerabilit...

CVE-2023-29435

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Zwaply Cryptocurrency All-in-One plugin = 3.0.19 versions...

CVE-2023-29435

CVE-2023-29435 : Auth. (contributor+) Stored Cross-Site Scripting (XSS) in the WordPress plugin “Cryptocurrency All-in-One” (WordPress Cryptocurrency All-in-One Plugin) up to version 3.0.19. Public data confirms the vulnerable component is the plugin; root cause is stored XSS as stated, with an a...

PT-2023-22259

Name of the Vulnerable Software and Affected Versions Zwaply Cryptocurrency All-in-One plugin versions prior to 3.0.20 Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, whi...

CVE-2023-29435: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Zwaply Cryptocurrency All-in-One plugin = 3.0.19 versions...

PT-2023-35876

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves several functions, including dwarf exec frame instr, dwarf get fde info for ...

all-in-oneauto.com Cross Site Scripting vulnerability OBB-3405827

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-32749: Incorrect Authorization

Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it is possible to assign the new user arbitrary roles. By assigning all roles to a newly created user, access to all...

CVE-2016-15033

The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php file in versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affecte...

CVE-2016-15033

The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php file in versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affecte...

WordPress Plugin Delete All Comments 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-10352 · WordPress · Delete All Comments

Name of the Vulnerable Software and Affected Versions: Delete All Comments plugin for WordPress versions up to, and including, 2.0 Description: The issue arises from missing file type validation in the delete-all-comments.php file, allowing unauthenticated attackers to upload arbitrary files on t...

CVE-2016-15033: Unrestricted Upload of File with Dangerous Type

The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php file in versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affecte...

PT-2023-11370

Name of the Vulnerable Software and Affected Versions GDPR Cookie Compliance plugin for WordPress versions up to, and including, 4.0.2 Description The issue is related to a missing capability check on the gdpr cookie compliance reset settings AJAX action, which allows authenticated attackers to...

Privilege Escalation

cassandra-all is vulnerable to Privilege Escalation. The vulnerability exists when enabling FQL/Audit logs, which allows an attacker with JMX access to run arbitrary commands...

DEBIAN-CVE-2023-33968

Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to a missing access control vulnerability that allows a user with low privileges to create or transfer tasks to any project within the software, even if they have not...