2110 matches found
CVE-2024-3028 Improper Input Validation in mintplex-labs/anything-llm
mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logofilename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the...
CVE-2024-3028
CVE-2024-3028 affects mintplex-labs/anything-llm. The issue is improper input validation in the system-preferences API where manipulating the logo_filename parameter can cause reading of arbitrary files (including .env) and deletion via remove-logo. Root cause: lack of proper sanitization of user...
CVE-2024-3028
mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logofilename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the...
Easy Logo <= 1.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting
Description The Easy Logo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
CVE-2024-3028: Improper Input Validation
mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logofilename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the...
CVE-2024-31086
Cross-Site Request Forgery CSRF vulnerability in Venugopal Change default login logo,url and title allows Cross-Site Scripting XSS.This issue affects Change default login logo,url and title: from n/a through 2.0...
CVE-2024-31086
CVE-2024-31086 is a CSRF-to-XSS vulnerability in the WordPress plugin “Change default login logo-url-and-title” affecting versions up to 2.0. The issue arises from a CSRF flaw that can lead to XSS on login page customization. No vendor-specific remediation or patch details are provided in the con...
WordPress Plugin Change default login logo,url and title 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Change default login...
PT-2024-23754
Name of the Vulnerable Software and Affected Versions Venugopal Change default login logo, url and title versions n/a through 2.0 Description The issue is related to a Cross-Site Request Forgery CSRF vulnerability that also allows Cross-Site Scripting XSS in the Change default login logo, url and...
CVE-2024-31086: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Venugopal Change default login logo,url and title allows Cross-Site Scripting XSS.This issue affects Change default login logo,url and title: from n/a through 2.0...
CVE-2024-32083
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Varun Kumar Easy Logo allows Stored XSS.This issue affects Easy Logo: from n/a through 1.9.3...
CVE-2024-32083 WordPress Easy Logo plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Varun Kumar Easy Logo allows Stored XSS.This issue affects Easy Logo: from n/a through 1.9.3...
CVE-2024-32083 WordPress Easy Logo plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Varun Kumar Easy Logo allows Stored XSS.This issue affects Easy Logo: from n/a through 1.9.3...
CVE-2024-32083
CVE-2024-32083 affects the Easy Logo WordPress plugin (Varun Kumar Easy Logo). It is a Stored XSS vulnerability caused by improper neutralization of input during web page generation, affecting Easy Logo versions up to 1.9.3. The entry indicates the issue is unpatched; no public remediation is doc...
WordPress Easy Logo plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Cronus Patchstack Alliance in WordPress Plugin Easy Logo versions = 1.9.3...
WordPress Plugin Easy Logo 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...
PT-2024-24388 · Varun Kumar · Easy Logo
Name of the Vulnerable Software and Affected Versions: Varun Kumar Easy Logo versions 1.9.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables attackers to inject...
WordPress Easy Logo Plugin <= 1.9.3 is vulnerable to Cross Site Scripting (XSS)
Software Easy Logo Type Plugin Vulnerable versions = 1.9.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32083 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ab618ce8f1b6 Credits Cronus Required privilege Administrator...
CVE-2024-32083: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Varun Kumar Easy Logo allows Stored XSS.This issue affects Easy Logo: from n/a through 1.9.3...