WordPress is vulnerable to Content Injection

Software WordPress Type WordPress Core Vulnerable versions = 6.2 Fixed in 6.2.1 OWASP Top 10 A1: Injection Classification Content Injection CVE N/A Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID a1a58401f3c0 Credits N/A Required privilege Contributor Published 17 May, 202...

rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations

A Cross-site scripting vulnerability was found in rails-html-sanitizer. Certain configurations of rails-html-sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags...

rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations

A Cross-site scripting vulnerability was found in rails-html-sanitizer. Certain configurations of rails-html-sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Privilege escalation for external users when OIDC is enabled under certain conditions Account takeover through open redirect for Group SAML accounts Users on banned IP addresses can still commit to projects User with developer role group can modify Protected branches setting on...

CVE-2022-3695

CVE-2022-3695 affects Hitachi Vantara Pentaho Business Analytics Server prior to 9.3.0.0, 9.2.0.4, and 8.3.0.27. The vulnerability arises when the CDE plugin is present and a malicious URL can inject content into a dashboard. Impact is content injection via URL provided to dashboards; exploitatio...

PT-2023-13514 · Hitachi Vantara · Pentaho Business Analytics Server

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.3.0.0 Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.2.0.4 Hitachi Vantara Pentaho Business Analytics Server versions prior to 8.3.0.27 Description:...

CVE-2022-4771

CVE-2022-4771 affects Hitachi Vantara Pentaho Business Analytics Server. The root cause is improper neutralization of input during web page generation, enabling cross-site scripting via session variables injected through a malicious URL. Affected versions are prior to 9.4.0.1 and 9.3.0.2, includi...

K22356857: APT remote code injection vulnerability CVE-2019-3462

Security Advisory Description Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine. CVE-2019-3462 Impact There is no impact; F5...

WordPress WoodMart Theme <= 7.0.4 is vulnerable to Content Injection

Software WoodMart Type Theme Vulnerable versions = 7.0.4 Fixed in 7.1.1 OWASP Top 10 A1: Injection Classification Content Injection CVE CVE-2023-25790 Patch priority Low CVSS severity Low 5.3 Developer Xtemos PSID b69ab1de1e4a Credits RE-ALTER Required privilege Unauthenticated Published 16...

SUSE CVE-2004-1158

Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window or tab whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka t...

SUSE CVE-2016-9902

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10...

SUSE CVE-2019-3462

Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine...

SUSE CVE-2020-12108

/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection...

SUSE CVE-2020-15011

GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page...

WordPress Spectra Plugin <= 2.3.0 is vulnerable to Content Injection

Software Spectra Type Plugin Vulnerable versions = 2.3.0 Fixed in 2.3.1 OWASP Top 10 A1: Injection Classification Content Injection CVE CVE-2023-23735 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID df80536f36d8 Credits Dave Jong Patchstack Required privilege Unauthenticat...

WordPress RegistrationMagic Plugin <= 5.1.9.2 is vulnerable to Content Injection

Software RegistrationMagic Type Plugin Vulnerable versions = 5.1.9.2 Fixed in 5.1.9.3 OWASP Top 10 A1: Injection Classification Content Injection CVE CVE-2023-23989 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 54c74a7cedb6 Credits yuyudhn Required privilege...

WordPress GPT3 AI Content Writer Plugin < 1.4.38 is vulnerable to Content Injection

Software GPT3 AI Content Writer Type Plugin Vulnerable versions 1.4.38 Fixed in 1.4.38 OWASP Top 10 A1: Injection Classification Content Injection CVE CVE-2023-0405 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 868b79c31d14 Credits Lana Codes Required privilege...

CVE-2023-0214 XSS in Skyhigh Security SWG

A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be...

McAfee Skyhigh Secure Web Gateway 跨站脚本漏洞

McAfee Skyhigh Secure Web Gateway McAfee Skyhigh SWG is a series of security gateways from McAfee, Inc. A security vulnerability in McAfee Skyhigh Secure Web Gateway versions 10.x prior to 10.2.17 and 11.x prior to 11.2.6 and 12.x prior to 12.0.1 stems from a vulnerability that could allow a remo...

External Control of Assumed-Immutable Web Parameter

Overview Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter due to improper escape of the " character in the generatemultipart function, which allows injecting malicious content to the filename parameter via the Content-Disposition header. PoC...