854 matches found
CVE-2023-44385
CVE-2023-44385 : Affects Home Assistant Companion for iOS and macOS up to version 2023.4. The vulnerability is a Client-Side Request Forgery that allows an attacker to lure a victim into visiting a malicious link or QR code, causing the victim to invoke arbitrary services on their Home Assistant ...
Home Assistant Companion Cross-Site Request Forgery Vulnerability
Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home Assistant Companion versions prior to 2023.7 that stems from the presence of a client request forgery vulnerability. An...
PT-2023-32153 · M Files · M-Files Web Companion
Name of the Vulnerable Software and Affected Versions: M-Files Web Companion versions prior to 23.10 M-Files Web Companion LTS Service Release Versions prior to 23.8 LTS SR1 Description: The issue is related to the execution of downloaded content, which allows for Remote Code Execution. This flaw...
PT-2023-29219 · Home Assistant · Home Assistant Companion
Name of the Vulnerable Software and Affected Versions: Home Assistant Companion for iOS and macOS versions up to 2023.4 Description: The issue allows attackers to send malicious links or QRs to victims, which can lead to calling arbitrary services in their Home Assistant installation. This can...
Home Assistant Code Issue Vulnerability
Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home Assistant Companion versions prior to 2023.7, which stems from a Server Request Forgery SSRF vulnerability in the component...
The reality of Apple watch pen testing
Introduction We were approached to do an Apple Watch application test. It seems this isnt a service offered by many companies including us, although we’ve done plenty of work on Android Wear before but also, little information exists online about attempts, experiences or if it’s even possible. So...
HCL Technologies Traveler Companion Information Disclosure Vulnerability
HCL Technologies Traveler Companion is an ios Iphone and Ipad application from HCL Technologies, USA. Used to read encrypted Hcl Notes emails on Apple devices. An information disclosure vulnerability exists in HCL Technologies Traveler Companion, which can be exploited by attackers to obtain...
CVE-2023-37512 HCL Traveler Companion is vulnerable to revealing sensitive information via the task switcher
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information...
HCL Technologies Traveler Companion 安全漏洞
HCL Technologies Traveler Companion is an ios Iphone and Ipad application from HCL Technologies, USA. Used to read encrypted Hcl Notes emails on Apple devices. An information disclosure vulnerability exists in HCL Technologies Traveler Companion, which can be exploited by attackers to obtain...
WordPress Blocksy Companion Plugin <= 1.8.46 is vulnerable to Cross Site Scripting (XSS)
Software Blocksy Companion Type Plugin Vulnerable versions = 1.8.46 Fixed in 1.8.47 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Creative Themes PSID ec10715e354a Credits Rafie Muhammad Patchstack Requir...
WordPress SV100 Companion Plugin <= 1.9.00 is vulnerable to Cross Site Scripting (XSS)
Software SV100 Companion Type Plugin Vulnerable versions = 1.9.00 Fixed in 2.0.00 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID b89ce4a4735c Credits Rafie Muhammad Patchstack Required...
WordPress OliveWP Companion Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)
Software OliveWP Companion Type Plugin Vulnerable versions = 1.1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7e6ce7e1f348 Credits Rafie Muhammad Patchstack Requir...
WordPress Kenta Companion Plugin < 1.1.9 is vulnerable to Cross Site Scripting (XSS)
Software Kenta Companion Type Plugin Vulnerable versions 1.1.9 Fixed in 1.1.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 66320b68639d Credits Rafie Muhammad Patchstack Required...
WordPress Webriti Companion Plugin < 1.9.3 is vulnerable to Cross Site Scripting (XSS)
Software Webriti Companion Type Plugin Vulnerable versions 1.9.3 Fixed in 1.9.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9145bb2b5a2a Credits Rafie Muhammad Patchstack Requir...
CVE-2023-1780
The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-1780
The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
WordPress plugin Companion Sitemap Generator 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
Companion Sitemap Generator < 4.5.3 - Reflected XSS
The plugin does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. PoC Make a logged-in admin open: https://example.com/wp-admin/tools.php?page=csg-sitemap=...
Companion Sitemap Generator < 4.5.3 - Reflected XSS
The plugin does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Make a logged-in admin open: https://example.com/wp-admin/tools.php?page=csg-sitemap&tabbed=...
