CVE-2023-31207

Transmission of credentials within query parameters in Checkmk = 2.1.0p26, = 2.0.0p35, and = 2.2.0b6 beta may cause the automation user's secret to be written to the site Apache access log...

CVE-2023-31207

Transmission of credentials within query parameters in Checkmk = 2.1.0p26, = 2.0.0p35, and = 2.2.0b6 beta may cause the automation user's secret to be written to the site Apache access log...

CVE-2023-31207

CVE-2023-31207 affects Checkmk; multiple connected sources confirm that transmitting credentials within query parameters can cause the automation user’s secret to be written to the site Apache access log. Affected streams include Checkmk versions ≤ 2.1.0p26, ≤ 2.0.0p35, and ≤ 2.2.0b6 (beta). The ...

CVE-2023-31207 Automation user secret logged to Apache access log

Transmission of credentials within query parameters in Checkmk = 2.1.0p26, = 2.0.0p35, and = 2.2.0b6 beta may cause the automation user's secret to be written to the site Apache access log...

Improper Authorization

modoboa is vulnerable to Missing Authorization. The vulnerability exists due to missing authorization checks on the /api/v2/parameters/core/ API endpoint which allows an attacker to gain sensitive information...

PT-2023-23230 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Checkmk versions 2.1.0 through 2.1.0p26 Checkmk versions 2.0.0 through 2.0.0p35 Checkmk versions 2.2.0b6 and earlier Description: The issue involves the transmission of credentials within query parameters, potentially causing the automation...

WordPress plugin StagTools 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

Wordpress Plugin BestWebSoft Job Board 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

WordPress plugin Product Catalog Feed by PixelYourSite 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Product Addons & Fields for WooCommerce < 32.0.7 - Reflected Cross-Site Scripting

The plugin does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting. PoC Ensure WooCommerce is installed. Visit the following path, while logged in as an Admin: /wp-admin/admin.php?page=ppomid=5meta=edit&"=1...

WordPress plugin Customer Reviews for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...

Concrete CMS missing secure cookie parameters

Concrete CMS previously concrete5 before 9.2 does not have Secure and HTTP only attributes set for ccmPoll cookies...

WP Search Analytics < 1.4.6 - Admin+ Stored XSS

The plugin does not sanitise and escape some parameters, which could allow users with a role of Administrator to perform Cross-Site Scripting attacks...

Design/Logic Flaw

mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration such that the token used in the password reset links remains valid even after the password reset and can be used a second time to change the password of the corresponding user. The token expires only 3...

mySCADA myPRO 操作系统命令注入漏洞

mySCADA myPRO is a software application. myPRO is a professional HMI/SCADA system designed for the visualization and control of industrial processes. An operating system command injection vulnerability exists in mySCADA myPRO version 8.26.0 and earlier versions. An attacker could exploit this...

mySCADA myPRO 操作系统命令注入漏洞

mySCADA myPRO is a software application. myPRO is a professional HMI/SCADA system designed primarily for the visualization and control of industrial processes. An operating system command injection vulnerability exists in mySCADA myPRO 8.26.0 and earlier versions, which can be exploited by an...

Online Book Store 1.0 SQL Injection

Exploit Title: Online Book Store 1.0 - process.php SQL injection Google Dork: 4/26/2023 Exploit Author: Or4nG.M4n Vendor Homepage: https://projectworlds.in/free-projects/php-projects/online-book-store-project-in-php/ Software Link:...

WP Inventory Manager < 2.1.0.13 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. 1. Go to WP Inventory Inventory Items and create a new Inventory Item. 2. Create a page and add the wpinventory shortcode. 3. View the new page on the frontend,...

Input validation

An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as...