com.alibaba.citrus:citrus-springext-all (>=3.1.6, <=3.2.4), com.alibaba.citrus:citrus-test-all (>=3.1.6, <=3.2.4) +62 more potentially affected by CVE-2023-20863 via org.springframework:spring-expression (3.2.7.release)

org.springframework:spring-expression MAVEN version 3.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.alibaba.citrus:citrus-springext-all =3.1.6, =3.1.6, =3.1.6, =0.10.0,...

CVE-2023-28828

A vulnerability has been identified in Polarion ALM All versions V22R2. The application contains a XML External Entity Injection XXE vulnerability. This could allow an attacker to view files on the application server filesystem...

PT-2023-20502 · Safe-Eval · Safe-Eval

Name of the Vulnerable Software and Affected Versions: safe-eval versions all Description: The issue arises from improper sanitization of the parameter content in the safeEval function, leading to Prototype Pollution. This affects all versions of the safe-eval package. Recommendations: For all...

CVE-2023-0157

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user admin+ to plant bogus log files containing malicious JavaScript code that will be executed in the context of any...

CVE-2023-0156

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only...

Code injection

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only...

CVE-2023-0157 All-In-One Security (AIOS) < 5.1.5 - Admin+ Stored XSS

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user admin+ to plant bogus log files containing malicious JavaScript code that will be executed in the context of any...

CVE-2023-0156 All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only...

CVE-2023-0156 All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only...

PT-2023-16046 · WordPress · All-In-One Security

Name of the Vulnerable Software and Affected Versions: All-In-One Security AIOS WordPress plugin versions prior to 5.1.5 Description: The issue allows an authorized user with admin+ privileges to plant bogus log files containing malicious JavaScript code. This code will be executed in the context...

PT-2023-16045 · WordPress · All-In-One Security

Name of the Vulnerable Software and Affected Versions: All-In-One Security AIOS WordPress plugin versions prior to 5.1.5 Description: The issue allows an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server, to which the web server has access...

CVE-2023-0157: Improper Neutralization of Input During Web Page Generation

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user admin+ to plant bogus log files containing malicious JavaScript code that will be executed in the context of any...

CVE-2023-0156: Improper Limitation of a Pathname to a Restricted Directory

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only...

WordPress Plugin All-In-One Security: Path traversal vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin of the WordPress Foundation. A path traversal vulnerability exists i...

WordPress Plugin All-In-One Security: Cross-Site Script Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Cryptocurrency All-in-One Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS)

Software Cryptocurrency All-in-One Type Plugin Vulnerable versions = 3.0.19 Fixed in N/A OWASP Top 10 A1: Injection Classification Cross Site Scripting XSS CVE CVE-2023-29435 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 156297bb9c33 Credits Mika Required privilege...

all-search.biz Cross Site Scripting vulnerability OBB-3241324

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress WP All Import v3.6.7 - Remote Code Execution Exploit

Exploit Title: WP All Import v3.6.7 - Remote Code Execution RCE Authenticated Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://www.wpallimport.com/ Software Link: https://wordpress.org/plugins/wp-all-import/advanced/ scroll down to select the version Version: =...

Malicious Package

Overview intstripesfra is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

io.apiman:apiman-distro-db (1.1.6.final), io.apiman:apiman-distro-db-es (1.1.6.final) +8 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (1.1.6.final)

io.apiman:apiman-manager-api-rest-impl MAVEN version 1.1.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-distro-db 1.1.6.final - io.apiman:apiman-distro-db-es...