Bonitasoft Cross-Site Scripting Vulnerability

Bonitasoft is an open source BPM software from Bonitasoft. A cross-site scripting vulnerability exists in Bonitasoft version v.7.14, which originates from a vulnerability that allows an attacker to execute arbitrary scripts via the Groups Display name field using a crafted payload...

CVE-2024-0256

The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Profile Display Name and Social Settings in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-0256

The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Profile Display Name and Social Settings in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Display Names Appear in Different Format When Using Multiple Identity Providers

When viewing Monitor or Studio, the list of user names may appear in a mix of different formats UPN, DisplayName, NETBIOS, SID...

PT-2024-4460 · Go +9 · Netmail +9

Name of the Vulnerable Software and Affected Versions: net/mail package in Go affected versions not specified Description: The issue is related to the ParseAddressList function, which incorrectly handles comments within display names. This can lead to different trust decisions being made by...

CVE-2023-48301 Nextcloud Server HTML injection in search UI when selecting a circle with HTML in the display name

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, an attacker could insert links into circles name that would be opened when clickin...

CVE-2023-28419

Cross-Site Request Forgery CSRF vulnerability in Stranger Studios Force First and Last Name as Display Name plugin = 1.2 versions...

CVE-2023-28419

Cross-Site Request Forgery CSRF vulnerability in Stranger Studios Force First and Last Name as Display Name plugin = 1.2 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Stranger Studios Force First and Last Name as Display Name plugin = 1.2 versions...

WordPress Plugin Force First and Last Name as Display Name Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress Plugin Force First and Last Name as Displ...

PT-2023-21705 · Stranger Studios · Stranger Studios Force First/Last Name As Display Name Plugin

Name of the Vulnerable Software and Affected Versions: Stranger Studios Force First and Last Name as Display Name plugin versions 1.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user int...

PYSEC-2023-219

Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any change...

Torchbox Wagtail Log Information Disclosure Vulnerability

Torchbox Wagtail is an open source content management system CMS from Torchbox UK. A security vulnerability exists in Wagtail that originates from a user with a Wagtail Administrator Limited Privilege Editor account that can retrieve any user's display name...

CVE-2023-38866

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and displayname...

CVE-2023-38866

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and displayname...

CVE-2023-28599

Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their display name potentially leading a victim to a malicious website during meeting creation...

PT-2023-21838 · Zoom · Zoom

Name of the Vulnerable Software and Affected Versions: Zoom versions prior to 5.13.10 Description: The issue allows a malicious user to inject HTML into their display name, potentially leading a victim to a malicious website during meeting creation. This occurs when a malicious user manipulates...

Zoom Client 注入漏洞

Zoom Client is a video conferencing client application from Zoom Inc. that supports multiple platforms. A security vulnerability exists in Zoom Client versions prior to 5.13.10 that stems from the inclusion of an HTML injection, which can be exploited by an attacker to inject HTML into the displa...

CVE-2023-1403

The Weaver Xtreme Theme for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 5.0.7. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary...

CVE-2023-1403

The Weaver Xtreme Theme for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 5.0.7. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary...