Cross site scripting

The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-2933

The 0mk Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the zeromkoptionspage function. This makes it possible for unauthenticated attackers to inject malicious web scripts vi...

CVE-2022-2933

The 0mk Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the zeromkoptionspage function. This makes it possible for unauthenticated attackers to inject malicious web scripts vi...

WordPress plugin 0mk Shortener 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2023-16112

Name of the Vulnerable Software and Affected Versions Contextual Related Posts WordPress plugin versions prior to 3.3.1 Description The issue concerns a lack of validation and escaping of certain block options in the Contextual Related Posts WordPress plugin. This could allow users with the...

PT-2023-12968

Name of the Vulnerable Software and Affected Versions 0mk Shortener plugin for WordPress versions up to, and including, 0.2 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the zeromk options page function. This allows unauthenticated...

PT-2023-15996

Name of the Vulnerable Software and Affected Versions MonsterInsights WordPress plugin versions prior to 8.12.1 Description The issue concerns the MonsterInsights WordPress plugin, which does not properly validate and escape certain block options before outputting them in a page or post where the...

CVE-2023-0252: Undefined Security Weakness

The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2023-16010

Name of the Vulnerable Software and Affected Versions Happyforms WordPress plugin versions prior to 1.22.0 Description The issue concerns the Happyforms WordPress plugin, which does not properly validate and escape certain block options before outputting them in a page or post where the block is...

PT-2023-15997

Name of the Vulnerable Software and Affected Versions ExactMetrics WordPress plugin versions prior to 7.12.1 Description The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the lack of validation and escaping of some block options befor...

CVE-2023-0095: Undefined Security Weakness

The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0082: Undefined Security Weakness

The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0081: Undefined Security Weakness

The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0096: Undefined Security Weakness

The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2023-16009

Name of the Vulnerable Software and Affected Versions Page View Count WordPress plugin versions prior to 2.6.1 Description The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the plugin's failure to validate and escape some of its block...

GHSA-9FQC-9CPR-W73Q froxlor is vulnerable to privilege escalation from customer to root via directory-options

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10...

froxlor is vulnerable to privilege escalation from customer to root via directory-options

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10...

Double Free

Overview Affected versions of this package are vulnerable to Double Free during options.kexalgorithms handling. The double free can be triggered by an unauthenticated attacker in the default configuration. Remediation A fix was pushed into the master branch but not yet published. References -...

CVE-2023-25136

OpenSSH server sshd 9.1 introduced a double-free vulnerability during options.kexalgorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One...

CVE-2023-25136

OpenSSH server sshd 9.1 introduced a double-free vulnerability during options.kexalgorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One...