CVE-2023-2869

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...

Design/Logic Flaw

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...

CVE-2023-2869 WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...

CVE-2023-23756

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script Elements...

PT-2023-19180 · Joomla · Onevote

Name of the Vulnerable Software and Affected Versions: oneVote component for Joomla affected versions not specified Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. It affects the oneVote component for Joomla,...

CVE-2023-23756: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script Elements...

CVE-2023-2852

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Softmed SelfPatron allows SQL Injection. This issue affects SelfPatron : before 2.0...

squidex 安全漏洞

squidex is a Headless CMS and Content Management Center. A security vulnerability exists in squidex versions prior to 7.4.0 that stems from improper handling of additional special elements...

The vulnerability of the command-line interface of ArubaOS systems allows a hacker to execute arbitrary commands.

The vulnerability of the command-line interface of ArubaOS exists because measures to neutralize the special elements used in the operating system’s command are not taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2023-2046 SQLi in Yontem Vehicle TrackingSsystem

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Yontem Informatics Vehicle Tracking System allows SQL Injection. This issue affects Vehicle Tracking System: before 8...

Azure DevOps Server 2022 XSS

The Microsoft Team Foundation Server or Azure DevOps install is missing security updates. It is, therefore, affected by a cross-site scripting vulnerability. An attacker who successfully exploited the vulnerability could access data that is available for the current user. Depending on the user's...

DEBIAN-CVE-2023-36823

Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a...

UBUNTU-CVE-2023-36823

Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a...

CVE-2023-36823

Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a...

PT-2023-8924 · Sanitize +2 · Sanitize +2

Name of the Vulnerable Software and Affected Versions: Sanitize versions 3.0.0 through 6.0.2 Description: The issue is related to the Sanitize HTML and CSS sanitizer, which can be exploited by an attacker using carefully crafted input to sneak arbitrary HTML and CSS through the sanitizer. This...

The vulnerability of the OpenBlob component in the console-based graphic editor ImageMagick allows a hacker to execute arbitrary code.

The vulnerability of the OpenBlob component in the console-based graphic editor ImageMagick exists because measures to neutralize special elements used in the operating system’s command line have not been implemented. Exploiting this vulnerability allows a remote attacker to execute arbitrary cod...

CVE-2023-36823: Improper Neutralization of Input During Web Page Generation

Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a...

WordPress All-in-one Floating Contact Form – My Sticky Elements Plugin < 2.1.2 is vulnerable to Cross Site Scripting (XSS)

Software All-in-one Floating Contact Form – My Sticky Elements Type Plugin Vulnerable versions 2.1.2 Fixed in 2.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3248 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox that originates from a website that may obscure full-screen notifications by introducing delays through complex calculation functions using option...

CVE-2023-3493 Improper Neutralization of Formula Elements in a CSV File in fossbilling/fossbilling

Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3...