Design/Logic Flaw

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

light-oauth2 Trust Management Issue Vulnerability

light-oauth2 is networknt open source a light-4j based fast , lightweight cloud-native OAuth 2.0 authorization microservice . light-oauth2 version 2.1.27 before the existence of a security vulnerability , the vulnerability stems from obtaining the public key without any validation , allowing an...

CVE-2023-31580

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

PT-2023-23396

Name of the Vulnerable Software and Affected Versions light-oauth2 versions prior to 2.1.27 Description The issue allows attackers to authenticate to the application with a crafted JWT token because the public key is obtained without verification. Recommendations For versions prior to 2.1.27,...

CVE-2023-31580: Improper Certificate Validation

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

CVE-2023-31580

CVE-2023-31580 affects light-oauth2 (before version 2.1.27). The root cause is that the library obtains the public key without verification, enabling a crafted JWT to authenticate to the application. Impact is authentication bypass for systems relying on this key verification. Remediation per ava...

CVE-2023-31580

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

Download canvasio3D Light <= 2.4.6 - Reflected XSS

Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-45062

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Thomas Scholl canvasio3D Light plugin = 2.4.6 versions...

CVE-2023-45062

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Thomas Scholl canvasio3D Light plugin = 2.4.6 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Thomas Scholl canvasio3D Light plugin = 2.4.6 versions...

CVE-2023-45062 WordPress Download canvasio3D Light Plugin <= 2.4.6 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Thomas Scholl canvasio3D Light plugin = 2.4.6 versions...

CVE-2023-45062

CVE-2023-45062 affects the WordPress plugin canvasio3D Light. The vulnerability is an unauthenticated, reflected Cross-Site Scripting (XSS) in canvasio3D Light, with vulnerable versions reported as &lt;= 2.4.6. The root cause is inadequate sanitization/escaping of input parameters before output, ...

PT-2023-29381

Name of the Vulnerable Software and Affected Versions Thomas Scholl canvasio3D Light plugin versions = 2.4.6 Description The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...

CVE-2023-45062: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Thomas Scholl canvasio3D Light plugin = 2.4.6 versions...

CVE-2023-45102

Cross-Site Request Forgery CSRF vulnerability in OTWthemes Blog Manager Light plugin = 1.20 versions...

CVE-2023-45102

Cross-Site Request Forgery CSRF vulnerability in OTWthemes Blog Manager Light plugin = 1.20 versions...

CVE-2023-45102

CVE-2023-45102 : Cross-Site Request Forgery in OTWthemes Blog Manager Light plugin (≤ 1.20). Exploitation requires an authenticated user? per Patchstack data, vulnerability permits unauthenticated actions. Patch/mitigation: update to a version higher than 1.20 (OTWthemes guidance references upgra...

CVE-2023-45102 WordPress Blog Manager Light Plugin <= 1.20 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in OTWthemes Blog Manager Light plugin = 1.20 versions...

PT-2023-29403 · Otwthemes · Otwthemes Blog Manager Light

Name of the Vulnerable Software and Affected Versions: OTWthemes Blog Manager Light plugin versions = 1.20 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is...