PT-2023-27915 · Geoserver · Geoserver

Name of the Vulnerable Software and Affected Versions: GeoServer versions prior to 2.22.5 GeoServer versions prior to 2.23.2 GeoServer version 2.10.3 GeoServer version 2.11.1 Description: The issue concerns the use of dynamic styles in GeoServer, which can lead to Service Side Request Forgery. Th...

CVE-2023-5467

The GEO my WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2023-5467

CVE-2023-5467 (GEO my WordPress) affects the GEO my WordPress plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping of shortcode attributes. It can be exploited by authenticated attackers with contributor-level or...

CVE-2023-5467

The GEO my WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

GEO my WordPress < 4.0.1 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2023-32122 · WordPress · Geo My Wordpress

Name of the Vulnerable Software and Affected Versions: GEO my WordPress plugin versions up to, and including, 4.0 Description: The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied attributes. This allows...

WordPress plugin GEO my WordPress Cross Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress GEO my WordPress Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS)

Software GEO my WordPress Type Plugin Vulnerable versions = 4.0 Fixed in 4.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5467 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d715adcd7e92 Credits Lana Codes Required...

CVE-2023-5467: Improper Neutralization of Input During Web Page Generation

The GEO my WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

Geokit Rails Code Issue Vulnerability

Geokit Rails is Geokit open source an official Geokit plugin for Rails/ActiveRecord . A security vulnerability exists in Geokit Rails versions prior to 2.5.0, which stems from a command injection attack due to insecure YAML deserialization in the geolocation cookie, which can be exploited by an...

PT-2023-20532 · Unknown · Geokit-Rails

Name of the Vulnerable Software and Affected Versions: geokit-rails versions prior to 2.5.0 Description: The issue is related to Command Injection due to unsafe deserialization of YAML within the geo location cookie. This can be exploited remotely via a malicious cookie value, allowing an attacke...

WordPress Geo Controller Plugin < 8.5.3 is vulnerable to Cross Site Scripting (XSS)

Software Geo Controller Type Plugin Vulnerable versions 8.5.3 Fixed in 8.5.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID aa9e59ed9408 Credits Unknown Required privilege...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geolocation' cookie. This issue can be exploited remotely via a malicious cookie value. Note: An attacker can use this vulnerability to execute commands on the host...

Cloud storage security: What’s new in the threat matrix

Today, we announce the release of a second version of the threat matrix for storage services, a structured tool that assists in identifying and analyzing potential security threats on data stored in cloud storage services. The matrix, first released in April 2021 as detailed in the blog post Thre...

Cloud storage security: What’s new in the threat matrix

Today, we announce the release of a second version of the threat matrix for storage services, a structured tool that assists in identifying and analyzing potential security threats on data stored in cloud storage services. The matrix, first released in April 2021 as detailed in the blog post Thre...

E-mailer Newsletter And Mailing System with Analytics + GEO location 1.16 Information Disclosure

================================================================================================================================== | Title : E-mailer Newsletter & Mailing System with Analytics + GEO location v1.16 information Disclosure vulnerability | | Author : indoushka | | Tested on : windows...

WordPress Interactive Geo Maps Plugin < 1.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Interactive Geo Maps Type Plugin Vulnerable versions 1.6.1 Fixed in 1.6.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9b4f22117bce Credits Rafie Muhammad Patchstack...

WordPress Geo Mashup Plugin < 1.13.12 is vulnerable to Cross Site Scripting (XSS)

Software Geo Mashup Type Plugin Vulnerable versions 1.13.12 Fixed in 1.13.12 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Dylan Kuhn PSID 0cbe2859392c Credits Rafie Muhammad Patchstack Required...

WordPress WordPress Cloaking – Show & Create Geo-Targeted Custom HTML Plugin – GeoRequest Plugin <= 0.2.0 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Cloaking – Show & Create Geo-Targeted Custom HTML Plugin – GeoRequest Type Plugin Vulnerable versions = 0.2.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim...

PT-2023-25275 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: The issue is related to improper input validation in the getLocationCache function of GeoLocation.java. This could allow sending a mock location during an emergency call, leading to loc...