PT-2023-30421 · Autel Robotics · Autel Robotics Evo Nano

Name of the Vulnerable Software and Affected Versions: Autel Robotics EVO Nano drone version 1.6.5 Description: The issue concerns insecure permissions in the setNFZEnable function, allowing attackers to breach the geo-fence and fly into no-fly zones. Recommendations: For Autel Robotics EVO Nano...

CVE-2023-47335

Insecure permissions in the setNFZEnable function of Autel Robotics EVO Nano drone v1.6.5 allows attackers to breach the geo-fence and fly into no-fly zones...

CVE-2023-47335

Insecure permissions in the setNFZEnable function of Autel Robotics EVO Nano drone v1.6.5 allows attackers to breach the geo-fence and fly into no-fly zones...

CVE-2023-47335

CVE-2023-47335 affects Autel Robotics EVO Nano drone v1.6.5. The issue is in the setNFZEnable function, where insecure permissions could allow bypassing the geo-fence and entering no-fly zones. Root cause: insecure permissions in the function. Potential impact: breach of restricted airspace as de...

grafana: persistent xss in grafana core plugins

A flaw was found in The GeoMap and Canvas plugins of Grafana. The GeoMap and Canvas plugins are core plugins in Grafana, which means that all Grafana instances have GeoMap and Canvas installed. These two plugins are vulnerable to Cross-site scripting, where an attacker with an Editor role can add...

geo-factum.de Improper Access Control vulnerability OBB-3773533

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-27915 · Geoserver · Geoserver

Name of the Vulnerable Software and Affected Versions: GeoServer versions prior to 2.22.5 GeoServer versions prior to 2.23.2 GeoServer version 2.10.3 GeoServer version 2.11.1 Description: The issue concerns the use of dynamic styles in GeoServer, which can lead to Service Side Request Forgery. Th...

CVE-2023-5467

The GEO my WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2023-5467

CVE-2023-5467 (GEO my WordPress) affects the GEO my WordPress plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping of shortcode attributes. It can be exploited by authenticated attackers with contributor-level or...

CVE-2023-5467

The GEO my WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

PT-2023-32122 · WordPress · Geo My Wordpress

Name of the Vulnerable Software and Affected Versions: GEO my WordPress plugin versions up to, and including, 4.0 Description: The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied attributes. This allows...

WordPress GEO my WordPress Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS)

Software GEO my WordPress Type Plugin Vulnerable versions = 4.0 Fixed in 4.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5467 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d715adcd7e92 Credits Lana Codes Required...

WordPress plugin GEO my WordPress Cross Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

GEO my WordPress < 4.0.1 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Geokit Rails Code Issue Vulnerability

Geokit Rails is Geokit open source an official Geokit plugin for Rails/ActiveRecord . A security vulnerability exists in Geokit Rails versions prior to 2.5.0, which stems from a command injection attack due to insecure YAML deserialization in the geolocation cookie, which can be exploited by an...

PT-2023-20532 · Unknown · Geokit-Rails

Name of the Vulnerable Software and Affected Versions: geokit-rails versions prior to 2.5.0 Description: The issue is related to Command Injection due to unsafe deserialization of YAML within the geo location cookie. This can be exploited remotely via a malicious cookie value, allowing an attacke...

WordPress Geo Controller Plugin < 8.5.3 is vulnerable to Cross Site Scripting (XSS)

Software Geo Controller Type Plugin Vulnerable versions 8.5.3 Fixed in 8.5.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID aa9e59ed9408 Credits Unknown Required privilege...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geolocation' cookie. This issue can be exploited remotely via a malicious cookie value. Note: An attacker can use this vulnerability to execute commands on the host...

Cloud storage security: What’s new in the threat matrix

Today, we announce the release of a second version of the threat matrix for storage services, a structured tool that assists in identifying and analyzing potential security threats on data stored in cloud storage services. The matrix, first released in April 2021 as detailed in the blog post Thre...

Cloud storage security: What’s new in the threat matrix

Today, we announce the release of a second version of the threat matrix for storage services, a structured tool that assists in identifying and analyzing potential security threats on data stored in cloud storage services. The matrix, first released in April 2021 as detailed in the blog post Thre...