Siemens LOGO! 8 BM Use of Hard-Coded Cryptographic Key (CVE-2020-25233)

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. The firmware update of affected devices contains the private RSA key that is used as a basis for encryption of communication with the device. This plugin only works with Tenable.ot. Please visit...

Siemens LOGO! 8 BM Insufficiently Protected Credentials (CVE-2020-25235)

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. The password used for authentication for the LOGO! Website and the LOGO! Access Tool is sent in a recoverable format. An attacker with access to the network traffic could derive valid logins. This plugin on...

Siemens LOGO! 8 BM Use of a Broken or Risky Cryptographic Algorithm (CVE-2020-25232)

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. Due to the usage of an insecure random number generation function and a deprecated cryptographic function, an attacker could extract the key that is used when communicating with an affected device on port...

Siemens LOGO! CMR and SIMATIC RTU 3000 Incorrect Calculation of Buffer Size (CVE-2020-36475)

An issue was discovered in Mbed TLS before 2.25.0 and before 2.16.9 LTS and before 2.7.18 LTS. The calculations performed by mbedtlsmpiexpmod are not limited; thus, supplying overly large parameters could lead to denial of service when generating Diffie- Hellman key pairs. This plugin only works...

CVE-2023-40932

A Cross-site scripting XSS vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means t...

CVE-2023-40932

A Cross-site scripting XSS vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means t...

Cross site scripting

A Cross-site scripting XSS vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means t...

Nagios XI Cross-Site Scripting Vulnerability

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A cross-site scripting vulnerability exists in Nagios XI 5.11.1 and earlier versions, which originates fro...

Stored XSS at LOGO+USER menu

Description Please enter a description of the vulnerability. Proof of Concept login with admin account visit https://demo.instantcms.io/admin/widgets?templatename=modern&scrollto=row-14 navigate to logo+user menu tab insert payload 1" onmouseover = "alert'hackedbytisha' at Parent row Tag CSS clas...

WordPress GS Logo Slider Plugin <= 3.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software GS Logo Slider Type Plugin Vulnerable versions = 3.4.2 Fixed in 3.4.3 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f9643d261af1 Credits István Márton Requir...

WP Adminify < 3.1.6 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Several fields in the plugin are...

CVE-2023-30875

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in All My Web Needs Logo Scheduler plugin = 1.2.0 versions...

CVE-2023-30875

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in All My Web Needs Logo Scheduler plugin = 1.2.0 versions...

CVE-2023-30875

The CVE CVE-2023-30875 affects the WordPress plugin Logo Scheduler (All My Web Needs) up to version 1.2.0. It is a stored cross-site scripting vulnerability exploitable by authenticated administrators (admin+) and was fixed in version 1.2.2. The issue’s existence and fix are corroborated by Patch...

CVE-2023-30875 WordPress Logo Scheduler Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in All My Web Needs Logo Scheduler plugin = 1.2.0 versions...

CVE-2023-30875 WordPress Logo Scheduler Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in All My Web Needs Logo Scheduler plugin = 1.2.0 versions...

WordPress plugin Logo Scheduler 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2023-23029 · Unknown · All My Web Needs Logo Scheduler

Name of the Vulnerable Software and Affected Versions: All My Web Needs Logo Scheduler plugin versions 1.2.0 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated administrators. This vulnerability allows for malicious scripts ...

Arbitrary file upload

Description Due to lack of file extension validation, privileged user administrator can upload arbitrary files with "update logo" and "update icon" features. The application uses the extension provided in the filename parameter. Proof of Concept POST /admin/default/jqadm/save/settings?locale=en...

PT-2023-5504 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI versions 5.11.1 and below Description: A Cross-site scripting XSS vulnerability in the Custom Logo component allows authenticated attackers to inject arbitrary javascript or HTML via the alt-text field. This affects all pages...