CVE-2022-4677

The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack...

Cross site scripting

The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack...

CVE-2022-4677

The CVE-2022-4677 entry corresponds to the Leaflet Maps Marker WordPress plugin (Google Maps/OpenStreetMap/Bing Maps) prior to version 3.12.7. The vulnerability arises from improper validation and escaping of a shortcode attribute, enabling Stored Cross-Site Scripting (Stored XSS) by users with a...

CVE-2022-4677 Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) < 3.12.7 - Contributor+ Stored XSS via Shortcode

The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack...

WordPress plugin Leaflet Maps Marker 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress Google Maps CP Plugin <= 1.0.43 is vulnerable to Broken Access Control

Software Google Maps CP Type Plugin Vulnerable versions = 1.0.43 Fixed in 1.0.44 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25039 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c47b9f1f0687 Credits István Márton Required...

GSD-2023-1001806 misc: fastrpc: Fix use-after-free race condition for maps

misc: fastrpc: Fix use-after-free race condition for maps This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.230 by commit...

GSD-2023-1001777 misc: fastrpc: Fix use-after-free race condition for maps

misc: fastrpc: Fix use-after-free race condition for maps This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.165 by commit...

GSD-2023-1001743 misc: fastrpc: Fix use-after-free race condition for maps

misc: fastrpc: Fix use-after-free race condition for maps This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.90 by commit...

GSD-2023-1001676 misc: fastrpc: Fix use-after-free race condition for maps

misc: fastrpc: Fix use-after-free race condition for maps This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.8 by commit...

PT-2023-34820 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.90 Description: The issue is related to the fastrpc component in the Linux Kernel, where a map is not properly removed on creater process and device release. The actual impact and attack plausibility have...

Interactive Geo Maps < 1.5.9 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Cross site scripting

There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks on the edited network maps, the XSS...

CVE-2022-43980 Cross-site scripting vulnerability in the network maps edit functionality

There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks on the edited network maps, the XSS...

CVE-2022-43980 Cross-site scripting vulnerability in the network maps edit functionality

There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks on the edited network maps, the XSS...

CVE-2022-43980

CVE-2022-43980 describes a stored cross-site scripting vulnerability in Pandora FMS v765 within the network maps editing feature. An attacker can edit a network map to inject an XSS payload; when an admin user clicks the edited map, the payload can execute and potentially exfiltrate the admin coo...

CVE-2023-22721

Auth. Stored Cross-Site Scripting XSS in Oi Yandex.Maps for WordPress = 3.2.7 versions...

WordPress plugin Oi Yandex.Maps 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

About the security content of iOS 15.7.3 and iPadOS 15.7.3

About the security content of iOS 15.7.3 and iPadOS 15.7.3 This document describes the security content of iOS 15.7.3 and iPadOS 15.7.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and...

Very Simple Google Maps < 2.9 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...