CVE-2022-1599

The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status draft, published, slug, post date, comment status enabled,...

Cross site request forgery (csrf)

The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status draft, published, slug, post date, comment status enabled,...

CVE-2022-1957

CVE-2022-1957 concerns the WordPress plugin Comment License prior to version 1.4.0. Affected component: the plugin’s settings update flow, which lacks CSRF verification. Root cause: missing CSRF check during settings updates. Impact: could allow an attacker to alter settings by inducing a logged-...

PT-2022-13996

Name of the Vulnerable Software and Affected Versions Admin Management Xtended WordPress plugin versions prior to 2.4.5 Description The issue allows attackers to make logged-in users with the right capabilities call certain AJAX actions without proper CSRF checks. This can lead to unauthorized...

WordPress plugin Admin Management Xtended 跨站请求伪造漏洞

WordPress and others are products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. Xtend and others are products of the Eclipse Foundation. Xtend is a general-purpose high-level programming language for the Java Virtual Machine. WordPress...

WordPress plugin Comment License 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. versions of the WordPress Comment License plugin prior to 1.4.0 are vulnerable to cross-site request...

CVE-2022-1957: Cross-Site Request Forgery (CSRF)

The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

PT-2022-14217

Name of the Vulnerable Software and Affected Versions Comment License WordPress plugin versions prior to 1.4.0 Description The issue concerns a lack of CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Recommendations For...

Improper Input Validation

In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state. A flaw was found in the Puppet...

Atlassian Jira 8.5.x < 8.18.0 (JRASERVER-72575)

The version of Atlassian Jira installed on the remote host is prior to 8.5.x 8.18.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-72575 advisory. - Information disclosure issue in the comment notification feature - CVE-2021-39120 CVE-2021-39120 Note that Nessus has...

The fee is not paid as intended for put orders

Lines of code Vulnerability details Impact MEDIUM - functions of the protocol could be impacted For put options, the fees are not paid as intended. Proof of Concept poc0: fee on non-exercised put option poc0 shows that fee is applied for put option, even though the option was not exercised. poc1:...

CVE-2022-34133

Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

Cross site scripting

Benjamin BALET Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

CVE-2022-34133

Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

CVE-2022-34133

Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

CVE-2022-34133

Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

PT-2022-22018 · Benjamin Balet · Jorani

Name of the Vulnerable Software and Affected Versions: Benjamin BALET Jorani version 1.0 Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability can be exploited via the Comment parameter at the application/controllers/Leaves.php endpoint. Recommendations...

Jorani 跨站脚本漏洞

Benjamin BALET Jorani is a leave management system from the French personal developer Benjamin BALET. Designed to provide small organizations with a simple workflow for leave and overtime requests, Benjamin BALET Jorani version 1.0 contains a cross-site scripting vulnerability stemming from a lac...

CVE-2022-34133: Improper Neutralization of Input During Web Page Generation

Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

puppetlabs-firewall: unmanaged rules could leave system in an unsafe state via duplicate comment

A flaw was found in the Puppet Firewall module. In certain situations, an unmanaged rule can exist on the target system that has the same comment as a rule specified in the manifest. When this condition is true, Puppet will ignore the unmanaged rule and continue to apply the rule in the manifest...