PT-2023-32680 · Thecosy · Thecosy Icecms

Name of the Vulnerable Software and Affected Versions: Thecosy IceCMS version 2.0.1 Description: A vulnerability was found in the Comment Like Handler component, affecting the processing of the file /Websquare/likeClickComment/. This issue leads to improper enforcement of a single, unique action...

CVE-2023-6466: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Thecosy IceCMS 2.0.1. It has been declared as problematic. This vulnerability affects unknown code of the file /planet of the component User Comment Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been...

CVE-2023-48330

Cross-Site Request Forgery CSRF vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery.This issue affects Bulk Comment Remove: from n/a through 2...

CVE-2023-48330

Cross-Site Request Forgery CSRF vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery.This issue affects Bulk Comment Remove: from n/a through 2...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery.This issue affects Bulk Comment Remove: from n/a through 2...

CVE-2023-48330

CVE-2023-48330 – WordPress Bulk Comment Remove CSRF (CSRF) vulnerability . The Bulk Comment Remove plugin (WordPress) is affected for versions <= 2, allowing Cross-Site Request Forgery. Public sources confirm the CVE and link it to unauthenticated CSRF risk with the vulnerable plugin, and Patc...

CVE-2023-48330 WordPress Bulk Comment Remove Plugin <= 2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery.This issue affects Bulk Comment Remove: from n/a through 2...

CVE-2023-48330 WordPress Bulk Comment Remove Plugin <= 2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery.This issue affects Bulk Comment Remove: from n/a through 2...

WordPress Plugin Bulk Comment Remove Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2023-30791 · Unknown · Mike Strand Bulk Comment Remove

Name of the Vulnerable Software and Affected Versions: Mike Strand Bulk Comment Remove versions prior to 2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is achieved by tricking the user...

CVE-2023-48330: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery.This issue affects Bulk Comment Remove: from n/a through 2...

Bulk Comment Remove <= 2 - Cross-Site Request Forgery via brc_admin()

Description The Bulk Comment Remove plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2. This is due to missing or incorrect nonce validation on the brcadmin function. This makes it possible for unauthenticated attackers to delete comments in bulk...

WordPress Bulk Comment Remove Plugin <= 2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Bulk Comment Remove Type Plugin Vulnerable versions = 2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-48330 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 07bea83de130 Credits Nguyen Xuan Chien...

CVE-2023-48031: Unrestricted Upload of File with Dangerous Type

OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions and upload a .bat file by manipulating the file's magic bytes to masquerade as an allowed type. This can enable the attacker to execute...

PT-2023-30676 · Unknown · Opensupports

Name of the Vulnerable Software and Affected Versions: OpenSupports version 4.11.0 Description: The issue allows an attacker to bypass security restrictions and upload a .bat file by manipulating the file's magic bytes to masquerade as an allowed type in the comment function. This can enable the...

CVE-2023-48031

OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions and upload a .bat file by manipulating the file's magic bytes to masquerade as an allowed type. This can enable the attacker to execute...

CISA Requests Comment on Draft Secure Software Development Attestation Form

CISA has opened a 30-day Federal Register notice to receive public comment on the draft Secure Software Development Attestation Form. CISA developed this form in coordination with the Office of Management and Budget. With the Secure Software Development Attestation Form, federal departments and...

Improper Access Control

microweber/microweber is vulnerable to Improper Access Control. This vulnerability exists because it does not properly restrict a user from commenting on an unpublished blog...

PT-2023-9143 · Unknown +2 · Stb Vorbis.C +2

Name of the Vulnerable Software and Affected Versions: stb vorbis.c version 1.22 Description: A heap-based buffer overflow vulnerability exists in the comment functionality of stb vorbis.c. A specially crafted .ogg file can lead to an out-of-bounds write. An attacker can provide a malicious file ...

ManageEngine ServiceDesk Plus < 14.1 Build 14103

The version of ManageEngine ServiceDesk Plus installed on the remote host is prior to 14.1 Build 14103. It is, therefore, affected by a vulnerability as referenced in the service-deskCVE-2023-23078 advisory. - Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the...