Siemens LOGO! Insufficiently Protected Credentials (CVE-2017-12734)

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V1.81.2. An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use...

Siemens LOGO! 8 BM Use of Hard-Coded Cryptographic Key (CVE-2020-25231)

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3, LOGO! Soft Comfort All versions V8.3. The encryption of program data for the affected devices uses a static key. An attacker could use this key to extract confidential information from protected program...

Siemens LOGO! CMR and SIMATIC RTU 3000 Improper Certificate Validation (CVE-2020-36478)

An issue was discovered in Mbed TLS before 2.25.0 and before 2.16.9 LTS and before 2.7.18 LTS. A NULL algorithm parameters entry looks identical to an array of REAL size zero and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate...

Siemens LOGO! CMR and SIMATIC RTU 3000 Incorrect Calculation of Buffer Size (CVE-2020-36475)

An issue was discovered in Mbed TLS before 2.25.0 and before 2.16.9 LTS and before 2.7.18 LTS. The calculations performed by mbedtlsmpiexpmod are not limited; thus, supplying overly large parameters could lead to denial of service when generating Diffie- Hellman key pairs. This plugin only works...

Siemens LOGO! Missing Authentication For Critical Function (CVE-2020-7589)

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions. The vulnerability could lead to an attacker reading and modifying the device configuration and obtain project files from affected devices. The security vulnerability could be exploited by an unauthenticated...

CVE-2023-40932

A Cross-site scripting XSS vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means t...

CVE-2023-40932

A Cross-site scripting XSS vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means t...

Cross site scripting

A Cross-site scripting XSS vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means t...

CVE-2023-40932: Improper Neutralization of Input During Web Page Generation

A Cross-site scripting XSS vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means t...

Nagios XI Cross-Site Scripting Vulnerability

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A cross-site scripting vulnerability exists in Nagios XI 5.11.1 and earlier versions, which originates fro...

Stored XSS at LOGO+USER menu

Description Please enter a description of the vulnerability. Proof of Concept login with admin account visit https://demo.instantcms.io/admin/widgets?templatename=modern&scrollto=row-14 navigate to logo+user menu tab insert payload 1" onmouseover = "alert'hackedbytisha' at Parent row Tag CSS clas...

WordPress GS Logo Slider Plugin <= 3.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software GS Logo Slider Type Plugin Vulnerable versions = 3.4.2 Fixed in 3.4.3 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f9643d261af1 Credits István Márton Requir...

WP Adminify < 3.1.6 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Several fields in the plugin are...

CVE-2023-30875

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in All My Web Needs Logo Scheduler plugin = 1.2.0 versions...

CVE-2023-30875

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in All My Web Needs Logo Scheduler plugin = 1.2.0 versions...

CVE-2023-30875 WordPress Logo Scheduler Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in All My Web Needs Logo Scheduler plugin = 1.2.0 versions...

CVE-2023-30875

The CVE CVE-2023-30875 affects the WordPress plugin Logo Scheduler (All My Web Needs) up to version 1.2.0. It is a stored cross-site scripting vulnerability exploitable by authenticated administrators (admin+) and was fixed in version 1.2.2. The issue’s existence and fix are corroborated by Patch...

CVE-2023-30875 WordPress Logo Scheduler Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in All My Web Needs Logo Scheduler plugin = 1.2.0 versions...

CVE-2023-30875: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in All My Web Needs Logo Scheduler plugin = 1.2.0 versions...

PT-2023-23029 · Unknown · All My Web Needs Logo Scheduler

Name of the Vulnerable Software and Affected Versions: All My Web Needs Logo Scheduler plugin versions 1.2.0 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated administrators. This vulnerability allows for malicious scripts ...