1282 matches found
CVE-2023-20238
A vulnerability in the single sign-on SSO implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to forge the credentials required to access an affected system. This vulnerability is due to th...
CVE-2023-41627
O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged routing tables to the device...
PYSEC-2023-164
borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives and potentially indirectly cause backup data loss in the repository. The attack requires an...
forge-et-fonderie.com Cross Site Scripting vulnerability OBB-3602846
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Code injection
Woodpecker is a community fork of the Drone CI system. In affected versions an attacker can post malformed webhook data witch lead to an update of the repository data that can e.g. allow the takeover of an repo. This is only critical if the CI is configured for public usage and connected to a for...
Woodpecker does not validate webhook before changing any data
Impact An attacker can post malformed webhook data which leads to an update of the repository data that can e.g. allow the takeover of a repository. This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage. Patches Please use either nex...
GHSA-4GCF-5M39-98MC Woodpecker does not validate webhook before changing any data
Impact An attacker can post malformed webhook data which leads to an update of the repository data that can e.g. allow the takeover of a repository. This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage. Patches Please use either nex...
CVE-2023-40034 Repositoty takeover in woodpecker-ci
Woodpecker is a community fork of the Drone CI system. In affected versions an attacker can post malformed webhook data witch lead to an update of the repository data that can e.g. allow the takeover of an repo. This is only critical if the CI is configured for public usage and connected to a for...
CVE-2023-37857
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to...
First Depositor Attack is possible by front-running mip00 script execution
Lines of code Vulnerability details Overview The First Depositor Attack Within the context of Compound v2, a First Depositor Attack occurs when an attacker becomes the inaugural minter of a cToken. This enables them to establish the first exchange rate between the underlying asset and the cToken...
TeleAdapt RoomCast TA-2400 Trust Management Issues Vulnerability
The TeleAdapt RoomCast TA-2400 is an all-in-one, self-contained, top-of-the-line content streaming box for guest rooms from TeleAdapt UK. A trust management issue vulnerability exists in TeleAdapt RoomCast TA-2400 versions 1.0 through 3.1, which stems from the presence of an issue with the use of...
CVE-2023-37976
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...
CVE-2023-37976
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...
Cross site scripting
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...
CVE-2023-37976 WordPress Radio Forge Muses Player with Skins Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...
CVE-2023-37976
CVE-2023-37976: Unauthenticated Reflected Cross-Site Scripting in WordPress Radio Forge Muses Player with Skins plugin (versions <= 2.5). The connected sources confirm the vulnerability is XSS with unauthenticated exposure and no publicly documented fix/version yet. Wordfence entries list the ...
WordPress Plugin Radio Forge Muses Player with Skins 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
Google Nest 授权问题漏洞
Google Nest is a smart home product by Google, an American company. Google Nest has a security vulnerability. The vulnerability allows unauthenticated nodes to forge radio frames using "Key ID Mode 2", a special mode that uses a static encryption key to bypass security checks, allowing arbitrary ...
CVE-2023-37291
Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter and exploit this vulnerability to access system to operate processes and access data. This issue affects Vitals ESP: from 3.0.8 through...
WordPress Radio Forge Muses Player with Skins Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)
Software Radio Forge Muses Player with Skins Type Plugin Vulnerable versions = 2.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-37976 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 433315cbcfd4 Credits L...