10716 matches found
CVE-2022-2398 WP Comments Fields < 4.1 - Admin+ Stored Cross-Site Scripting
The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
CVE-2022-2398
CVE-2022-2398 concerns the WordPress Comments Fields plugin (pre-4.1). The flaw is a lack of escaping in the Field Error Message, enabling stored Cross-Site Scripting by high-privilege admins (authenticated users) even when unfiltered_html is disallowed. Affected version: WordPress Comments Field...
PT-2022-16382 · WordPress · Wordpress Comments Fields
Name of the Vulnerable Software and Affected Versions: WordPress Comments Fields WordPress plugin versions prior to 4.1 Description: The issue allows high-privileged users to perform Cross-Site Scripting attacks due to the lack of escaping in Field Error Message, even when unfiltered html is...
WordPress plugin WordPress Comments Fields 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
protobuf-java: potential DoS in the parsing procedure for binary data
A flaw was found in protobuf-java. Google Protocol Buffer protobuf-java allows the interleaving of com.google.protobuf.UnknownFieldSet fields. By persuading a victim to open specially-crafted content, a remote attacker could cause a timeout in the ProtobufFuzzer function, resulting in a denial of...
WordPress Advanced Custom Fields plugin <= 5.12.2 - Unauthenticated File Upload vulnerability
Unauthenticated File Upload vulnerability discovered by James Golovich in WordPress Advanced Custom Fields plugin versions = 5.12.2. Solution Update the WordPress Advanced Custom Fields plugin to the latest available version at least 5.12.3...
WordPress Advanced Custom Fields PRO premium plugin <= 5.12.2 - Unauthenticated File Upload vulnerability
Unauthenticated File Upload vulnerability discovered by James Golovich in WordPress Advanced Custom Fields PRO premium plugin versions = 5.12.2. Solution Update the WordPress Advanced Custom Fields PRO plugin to the latest available version at least 5.12.3...
CVE-2022-36902
Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
CVE-2022-2340
CVE-2022-2340 — Affected: W-DALIL WordPress plugin (≤ 2.0). Description: non-sanitized/escaped fields allow Stored XSS when unfiltered_html is disallowed (e.g., multisite). Impact: potential for script execution by high-privilege authenticated users (admin). CVSS 3.1 base score 4.8 (Medium) with ...
Input validation
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...
Cisco Small Business 缓冲区错误漏洞
Cisco Small Business is a switch from Cisco, U.S.A. A buffer overflow vulnerability exists in Cisco Small Business RV110W, RV130, RV130W, RV215W Routers, which stems from insufficient authentication of user fields in incoming HTTP packets. An attacker could use this vulnerability to execute...
Input validation
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...
CVE-2022-20888 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...
nodejs: Incorrect handling of certificate subject and issuer fields
A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries...
CVA6 安全漏洞
CVA6 is an application class 6 RISC-V CPU open-sourced by the OpenHW Group in Canada. A security vulnerability exists in CVA6, which stems from the mstatus.sd field not being updated when the mstatus.fs field is set to Dirty...
CVE-2022-2118
The 404s WordPress plugin before 3.5.1 does not sanitise and escape its fields, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
WP Comments Fields < 4.1 - Admin+ Stored Cross-Site Scripting
The plugin does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed Create/edit a Comment Fields Comments Comment Fields and put the following payload in the Error Message setting: "autofocus...
WordPress WP Comments Fields plugin <= 4.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Rafshanzani Suhada in WordPress WP Comments Fields plugin versions = 4.0. Solution Update the WordPress WordPress Comments Fields plugin to the latest available version at least 4.1...
Framework: Data Binding Rules Vulnerability
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the fiel...