103 matches found
WordPress plugin WP GPX Map security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
CVE-2023-44234: Missing Authorization
Missing Authorization vulnerability in Bastianon Massimo WP GPX Map.This issue affects WP GPX Map: from n/a through 1.7.08...
WP GPX Map < 1.7.06 - Missing Authorization
Description The WP GPX Map plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpgpxmapsdismissnotice function in versions up to, and including, 1.7.05. This makes it possible for authenticated attackers, with subscriber-level access an...
NI DIAdem GPX File Parsing XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of NI DIAdem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing o...
CVE-2023-5136
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file...
Information disclosure
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file...
CVE-2023-5136 Incorrect Permission Assignment in the TopoGrafix DataPlugin for GPX
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file...
CVE-2023-5136 Incorrect Permission Assignment in the TopoGrafix DataPlugin for GPX
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file...
CVE-2023-5136
The connected advisories confirm a vulnerability in NI DIAdem GPX processing via the TopoGrafix DataPlugin for GPX. The root cause is an XML External Entity (XXE) handling flaw that allows a crafted GPX file to cause the XML parser to fetch and embed external content, leading to information discl...
CVE-2023-5136: Improper Restriction of XML External Entity Reference
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file...
WordPress WP GPX Map Plugin <= 1.7.08 is vulnerable to Broken Access Control
Software WP GPX Map Type Plugin Vulnerable versions = 1.7.08 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-44234 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 03364e36fe8f Credits Abdi Pranata Required privilege...
SUSE CVE-2020-14940
An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 .gpx and GP7 .gp tablature files...
GHSA-VV3R-FXQP-VR3F XSS via uploaded gpx file
A malicious content author could upload a GPX file with a Javascript payload. The payload could then be executed by luring a legitimate user to view the file in a browser with support for GPX files. GPX is an XML-based format used to store GPS data. By default, Silverstripe CMS will no longer all...
XSS via uploaded gpx file
A malicious content author could upload a GPX file with a Javascript payload. The payload could then be executed by luring a legitimate user to view the file in a browser with support for GPX files. GPX is an XML-based format used to store GPS data. By default, Silverstripe CMS will no longer all...
PT-2022-24239 · Silverstripe · Silverstripe/Framework
Name of the Vulnerable Software and Affected Versions: Silverstripe silverstripe/framework versions 4.11 and earlier Description: The issue allows for XSS attacks. A malicious content author could upload a GPX file with a Javascript payload. The payload could then be executed by luring a legitima...
CVE-2022-38147 - XSS via uploaded gpx file
More info at https://www.silverstripe.org/download/security-releases/cve-2022-38147...
Malicious Package in leaflet-gpx
Version 1.0.1 of leaflet-gpx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluate yo...
GHSA-GJC9-932X-C59P Malicious Package in leaflet-gpx
Version 1.0.1 of leaflet-gpx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluate yo...
DEBIAN-CVE-2020-14940
An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 .gpx and GP7 .gp tablature files...
CVE-2020-14940
CVE-2020-14940 affects TuxGuitar 1.5.4, specifically io/gpx/GPXDocumentReader.java, where misconfigured XML parsers cause an XXE when loading GP6 (.gpx) and GP7 (.gp) tablature files. Exploitation details or fixes are not provided in the connected documents; the NVD entry lists CVSSv3.1 base scor...