9965 matches found
Cross site scripting
The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-2518 Easy Forms for Mailchimp < 6.8.9 - Reflected XSS
The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-2518: Undefined Security Weakness
The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
SUSE CVE-2023-33297
Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service e.g., CPU consumption because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023...
SUSE CVE-2023-32324
OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service DoS attack. A buffer overflow vulnerability in the function formatlogline could allow remote attackers to cause a DoS ...
Code injection
Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service e.g., CPU consumption because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023...
Easy Forms for Mailchimp < 6.8.9 - Reflected XSS
The plugin does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. When the debug settings is enabled ie...
VulnCheck KEV: CVE-2023-33297
Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service e.g., CPU consumption because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023...
Easy Forms for Mailchimp < 6.8.9 - Reflected XSS
The plugin does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. PoC When the debug settings is enabled ie...
CVE-2023-1618
Active Debug Code vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 Serial number 2310 and prior allows a remote unauthenticated attacker to bypass authentication and illegally log into the affected module by connecting to it via telnet which is hidden function and i...
CVE-2023-1618 Authentication Bypass Vulnerability in MELSEC WS Series Ethernet Interface Module
Active Debug Code vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 Serial number 2310 and prior allows a remote unauthenticated attacker to bypass authentication and illegally log into the affected module by connecting to it via telnet which is hidden function and i...
Mitsubishi Electric MELSEC WS Series
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Equipment: WS0-GETH00200 Vulnerabilities: Active Debug Code 2. UPDATE OR REPOSTED INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-23-138-02...
CVE-2023-2739: Improper Neutralization of Input During Web Page Generation
A vulnerability classified as problematic was found in Gira HomeServer up to 4.12.0.220829 beta. This vulnerability affects unknown code of the file /hslist. The manipulation of the argument lst with the input debug%27" leads to cross site scripting. The attack can be initiated remotely. The...
Information Disclosure
github.com/elastic/beats is vulnerable to Information Disclosure. A local authenticated attacker is able to gain access to http request authorization or proxy-authorization header contents through leaked logs due to a flaw in httpjson input when debug logging is enabled, resulting in disclosure o...
CVE-2023-29791
kodbox = 1.37 is vulnerable to Cross Site Scripting XSS via the debug information...
CVE-2023-29791
kodbox = 1.37 is vulnerable to Cross Site Scripting XSS via the debug information...
Cross site scripting
kodbox = 1.37 is vulnerable to Cross Site Scripting XSS via the debug information...
CVE-2023-29791
kodbox = 1.37 is vulnerable to Cross Site Scripting XSS via the debug information...
CVE-2023-29791: Improper Neutralization of Input During Web Page Generation
kodbox = 1.37 is vulnerable to Cross Site Scripting XSS via the debug information...
CVE-2023-29791
CVE-2023-29791 affects kodbox versions 1.37 and earlier, with a Cross‑Site Scripting (XSS) flaw exposed via debug information. The vulnerability allows crafted debug output to be reflected in the UI, enabling user‑in‑context script execution. The advisory entries consistently identify the vulnera...