PT-2023-17743 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-11 through Android-13 Description: In the onPrepareOptionsMenu method of AppInfoDashboardFragment.java, there is a possible way to bypass admin restrictions and uninstall applications for all users due to a missing...

CVE-2023-28335: Cross-Site Request Forgery (CSRF)

The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk...

Medium: rust

Issue Overview: Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the /.cargo folder on disk, making it available to the Rust projects it builds. To reco rd when an extraction is successful, Cargo writes "ok" to the...

CVE-2023-0937

The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

Cross site scripting

The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

CVE-2023-0937 VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS

The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

CVE-2023-0937 VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS

The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

CVE-2023-0937

The CVE-2023-0937 entry concerns the VK All in One Expansion Unit WordPress plugin prior to 9.87.1.0. The root cause is failure to escape the $_SERVER[REQUEST_URI] value before echoing it into an attribute, enabling Reflected Cross-Site Scripting. Affected component is the WordPress plugin code h...

All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal

The plugin does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only displays the last 50 lines of the file. PoC POST...

CVE-2023-0937: Undefined Security Weakness

The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU resulting in a denial of service condition.

...

all-mice.co.kr Cross Site Scripting vulnerability OBB-3208339

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-20498 · Unknown · Node-Static

Name of the Vulnerable Software and Affected Versions: @node-static versions all node-static versions all Description: The issue arises from improper file path sanitization in the startsWith method within the servePath function, leading to Directory Traversal. This allows attackers to access file...

CVE-2022-46806

Cross-Site Request Forgery CSRF vulnerability in VillaTheme Cart All In One For WooCommerce plugin = 1.1.10 leading to cart modification...

CVE-2022-46806 WordPress Cart All In One For WooCommerce Plugin <= 1.1.10 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in VillaTheme Cart All In One For WooCommerce plugin = 1.1.10 leading to cart modification...

CVE-2022-46806

CVE-2022-46806 affects VillaTheme Cart All In One For WooCommerce plugin ( 1.1.10 (Patchstack lists 1.1.11 as fixed). Exploitation details are not provided in the documents, and there are no confirmed in‑the‑wild exploit links within the connected documents.

CVE-2022-46797

Cross-Site Request Forgery CSRF vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin = 5.2.3 leads to plugin settings change...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin = 5.2.3 leads to plugin settings change...

CVE-2023-23974

Cross-Site Request Forgery CSRF vulnerability in Fullworks Quick Event Manager plugin = 9.7.4 affecting all registration actions delete, delete all, edit, update...

Malicious Package

Overview flpall is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...