CVE-2020-36753

The Hueman theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation on the savemetabox function. This makes it possible for unauthenticated attackers to save metabox data via a forged request...

WordPress theme Hueman Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports personal blog sites on PHP and MySQL servers.WordPress theme is a theme for WordPress. A security vulnerability exists in WordPress theme Hueman, which stems from a missing or incorrect random...

WordPress Plugin Magic Action Box Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

agora (=0.1.0), ashpd (>=0.2.0-alpha <=0.2.0-alpha-3) +29 more potentially affected by CVE-2024-43806 via rustix (=0.37.13)

rustix CARGO version =0.37.13 is affected by a known vulnerability. The following packages have a transitive dependency on rustix and may be impacted: - agora =0.1.0 - ashpd =0.2.0-alpha, =0.2.0, =1.0.2, =0.6.0, =0.4.0, =0.2.0, =0.2.0-beta.4, =0.25.0, =0.4.8, =0.6.2 and more Source cves:...

UBUNTU-CVE-2023-22098

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

Popup box < 3.7.2 - Admin+ Stored Cross-Site Scripting

Description The plugin does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfilteredhtml capability is disallowed for example in a multisite setup. 1. Create a new PopUp Box within the plugi...

Popup box < 3.7.2 - Admin+ Stored Cross-Site Scripting

Description The plugin does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfilteredhtml capability is disallowed for example in a multisite setup. PoC 1. Create a new PopUp Box within the...

CSRF in Save Box Settings

Description CSRF in Save Box Settings Proof of Concept 1 .Attacker send form fake to user history.pushState'', '', '/'; document.forms0.submit; 2 .User click, interface home changed Video Poc https://drive.google.com/file/d/18y9P7SZuHgNC3uzmD50Xo82Yrmp5V4VS/view?usp=sharing...

WordPress Magic Action Box Plugin <= 2.17.2 is vulnerable to Cross Site Scripting (XSS)

Software Magic Action Box Type Plugin Vulnerable versions = 2.17.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5231 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2d85f5acc350 Credits Lana Codes Required...

sing-box vulnerable to improper authentication in the SOCKS inbound

Impact This vulnerability allows specially crafted requests to bypass authentication, affecting all SOCKS inbounds with user authentication. Patches Update to sing-box 1.4.5 or 1.5.0-rc.5 and later versions. Workarounds Don't expose the SOCKS5 inbound to insecure environments...

GHSA-R5HM-MP3J-285G sing-box vulnerable to improper authentication in the SOCKS inbound

Impact This vulnerability allows specially crafted requests to bypass authentication, affecting all SOCKS inbounds with user authentication. Patches Update to sing-box 1.4.5 or 1.5.0-rc.5 and later versions. Workarounds Don't expose the SOCKS5 inbound to insecure environments...

CVE-2023-43644

Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to...

Authentication flaw

Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to...

CVE-2023-43644

CVE-2023-43644 affects sing-box and enables an authentication bypass for all SOCKS5 inbounds with user authentication via specially crafted requests. The impact is an authentication bypass with potential high-severity consequences. Affected versions require updating to sing-box 1.4.4 or 1.5.0-rc....

CVE-2023-43644 Improper authentication in the SOCKS5 inbound in sing-box

Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to...

CVE-2023-43644 Improper authentication in the SOCKS5 inbound in sing-box

Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to...

CVE-2023-43644 Improper authentication in the SOCKS5 inbound in sing-box

Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to...

CVE-2023-0626

Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route. This issue affects Docker Desktop: before 4.12.0...

CVE-2023-0626

Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route. This issue affects Docker Desktop: before 4.12.0...

CVE-2023-0626 Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route

Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route. This issue affects Docker Desktop: before 4.12.0...