CVE-2023-28670: Improper Neutralization of Input During Web Page Generation

Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stored cross-site scripting XSS vulnerability exploitable by authenticated attackers with Overall/Read permission...

Stored XSS vulnerability in pipeline-aggregator-view

pipeline-aggregator-view 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript. This results in a stored cross-site scripting XSS vulnerability exploitable by authenticated attackers with Overall/Read permission. pipeline-aggregator-view 1.14 obtains...

GSD-2023-1002118 platform/surface: aggregator: Add missing call to ssam_request_sync_free()

platform/surface: aggregator: Add missing call to ssamrequestsyncfree This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.89 by commit...

GSD-2023-1001989 platform/surface: aggregator: Add missing call to ssam_request_sync_free()

platform/surface: aggregator: Add missing call to ssamrequestsyncfree This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.7 by commit...

GSD-2023-1001755 platform/surface: aggregator: Add missing call to ssam_request_sync_free()

platform/surface: aggregator: Add missing call to ssamrequestsyncfree This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.89 by commit...

GSD-2023-1001694 platform/surface: aggregator: Add missing call to ssam_request_sync_free()

platform/surface: aggregator: Add missing call to ssamrequestsyncfree This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.7 by commit...

CVE-2022-4667

The RSS Aggregator by Feedzy WordPress plugin before 4.1.1 does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

CVE-2022-4667

The RSS Aggregator by Feedzy WordPress plugin before 4.1.1 does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

CVE-2022-4667

The CVE-2022-4667 entry points to the WordPress plugin RSS Aggregator by Feedzy, affected in versions prior to 4.1.1. The root cause is that certain block options are not validated or escaped before being echoed on the page, enabling Stored XSS. This could allow a user with Contributor-level or s...

WordPress plugin RSS Aggregator by Feedzy 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

CVE-2022-4667: Improper Neutralization of Input During Web Page Generation

The RSS Aggregator by Feedzy WordPress plugin before 4.1.1 does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

PT-2023-14984 · WordPress · The Rss Aggregator By Feedzy

Name of the Vulnerable Software and Affected Versions: The RSS Aggregator by Feedzy WordPress plugin versions prior to 4.1.1 Description: The issue allows users with a role as low as contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such ...

Upgraded Q -> M from #472 [1674665995647]

Judge has assessed an item in Issue 472 as M risk. The relevant finding follows: L-01 CHAINLINK AGGREGATOR IS NOT SUFFICIENTLY VALIDATED AND CAN RETURN STALE ANSWER As shown below, calling the getAssetPrice function in the ParaSpaceOracle contract can execute price = uint256source.latestAnswer,...

PT-2024-11812

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue is related to a missing call to ssam request sync free in the platform/surface: aggregator component. Although rare, ssam...

Hewlett Packard Enterprise OfficeConnect 路径遍历漏洞

Hewlett Packard Enterprise OfficeConnect is a series of switches from Hewlett Packard Enterprise USA. A security vulnerability exists in Hewlett Packard Enterprise OfficeConnect. An attacker could exploit the vulnerability to read arbitrary files on the server running the application. The followi...

WordPress RSS Aggregator by Feedzy Plugin < 4.1.1 is vulnerable to Cross Site Scripting (XSS)

Software RSS Aggregator by Feedzy Type Plugin Vulnerable versions 4.1.1 Fixed in 4.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4667 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID cee226bbb884 Credits István Márt...

RSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. PoC 1. Add the Feedz...

RSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. 1. Add the Feedzy RS...

Double free

FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords brypt with cost 9, salted of FreshRSS Web interface. If the API is used, the configuration might contain a...

CVE-2022-23497 Insecure file access in FreshRSS

FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords brypt with cost 9, salted of FreshRSS Web interface. If the API is used, the configuration might contain a...