8736 matches found
CVE-2022-22944
VMware Workspace ONE Boxer contains a stored cross-site scripting XSS vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE Boxer calendar event descriptions, a malicious actor can inject script tags to execute arbitrary script within a user's window...
CVE-2022-22944
VMware Workspace ONE Boxer contains a stored cross-site scripting XSS vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE Boxer calendar event descriptions, a malicious actor can inject script tags to execute arbitrary script within a user's window...
Cross site scripting
VMware Workspace ONE Boxer contains a stored cross-site scripting XSS vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE Boxer calendar event descriptions, a malicious actor can inject script tags to execute arbitrary script within a user's window...
CVE-2022-22944
VMware Workspace ONE Boxer contains a stored cross-site scripting XSS vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE Boxer calendar event descriptions, a malicious actor can inject script tags to execute arbitrary script within a user's window...
Amelia < 1.0.47 - Unauthenticated Stored XSS via lastName
The plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter found in the /src/Application/Controller/User/Customer/AddCustomerController.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever...
[SECURITY] Fedora 35 Update: seamonkey-2.53.11-1.fc35
SeaMonkey is an all-in-one Internet application suite previously made popular by Netscape and Mozilla. It includes an Internet browser, advanced e-mail, newsgroup and feed client, a calendar, IRC client, HTML editor and a tool to inspect the DOM for web pages. It is derived from the application...
Privilege Escalation
rundeck-authz-core is vulnerable to privilege escalation. An attacker can modify or delete system or project-level calendars by sending a malicious request without having proper authorization...
CVE-2021-41112
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing calendars could...
CVE-2021-41112 Missing Authorization in Rundeck
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing calendars could...
WordPress Elegant Calendar Lite – WordPress Events Calendar Plugin plugin < 1.5.8 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Elegant Calendar Lite – WordPress Events Calendar Plugin plugin versions 1.5.8. Solution Update the WordPress Elegant Calendar Lite – WordPress Events Calendar Plugin plugin to the latest available...
WordPress The Events Calendar plugin < 5.14.0.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress The Events Calendar plugin versions 5.14.0.4. Solution Update the WordPress The Events Calendar plugin to the latest available version at least 5.14.0.4...
WordPress Subscriber Addons for The Events Calendar plugin < 2.0.1 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Subscriber Addons for The Events Calendar plugin versions 2.0.1. Solution Update the WordPress Subscriber Addons for The Events Calendar plugin to the latest available version at least 2.0.1...
WordPress Elegant Calendar Lite – WordPress Events Calendar Plugin plugin < 1.5.8 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Elegant Calendar Lite – WordPress Events Calendar Plugin plugin versions 1.5.8. Solution Update the WordPress Elegant Calendar Lite – WordPress Events Calendar Plugin plugin to the latest available version at least 1.5.8...
WordPress Subscriber Addons for The Events Calendar plugin < 2.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Subscriber Addons for The Events Calendar plugin versions 2.0.1. Solution Update the WordPress Subscriber Addons for The Events Calendar plugin to the latest available version at least 2.0.1...
WordPress Slider Addons for The Events Calendar plugin < 1.0.1 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Slider Addons for The Events Calendar plugin versions 1.0.1. Solution Update the WordPress Slider Addons for The Events Calendar plugin to the latest available version at least 1.0.1...
WordPress WP School Calendar plugin <= 3.5.10 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress WP School Calendar plugin versions = 3.5.10. Solution Update the WordPress WP School Calendar plugin to the latest available version at least 3.6...
WordPress The Events Calendar plugin < 5.14.0.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress The Events Calendar plugin versions 5.14.0.4. Solution Update the WordPress The Events Calendar plugin to the latest available version at least 5.14.0.4...
WordPress Events Calendar Registration plugin <= 1.9.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Events Calendar Registration plugin versions = 1.9.2. Solution No patched version available...
WordPress The Events Calendar plugin < 5.14.0.4 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress The Events Calendar plugin versions 5.14.0.4. Solution Update the WordPress The Events Calendar plugin to the latest available version at least 5.14.0.4...
Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site Scripting
The plugin does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks PoC As a contributor, create/edit an Event, add the following payload in a "Hourly Schedule" title, as well as an...