402 matches found
CVE-2023-30787
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the people:id/introductions endpoint and firstmetadditionalinfo parameter...
Code injection
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the people:id/work endpoint and job and company parameter...
MonicaHQ 跨站脚本漏洞
MonicaHQ is a relationship management system from MonicaHQ, Inc. A security vulnerability exists in MonicaHQ version 4.0.0, which can be exploited by a remote attacker to execute malicious code in the application via the people:id/relationships endpoint and CSTIs in the firstname and lastname...
MonicaHQ 跨站脚本漏洞
MonicaHQ is a people management system from MonicaHQ, Inc. A security vulnerability exists in MonicaHQ version 4.0.0, which can be exploited by remote attackers to execute malicious code in the application via the people/add endpoint and CSTIs in the job and company parameters...
CVE-2023-30790
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the people:id/relationships endpoint and firstname and lastname parameter...
PT-2023-16749 · Monicahq · Monicahq
Name of the Vulnerable Software and Affected Versions: MonicaHQ version 4.0.0 Description: The issue allows an authenticated remote attacker to execute malicious code in the application via CSTI in the "people:id/food" endpoint and food parameter. Recommendations: For MonicaHQ version 4.0.0, as a...
PT-2023-22983 · Monicahq · Monicahq
Name of the Vulnerable Software and Affected Versions: MonicaHQ version 4.0.0 Description: The issue allows an authenticated remote attacker to execute malicious code in the application via CSTI in the "people:id/relationships" endpoint, specifically using the first name and last name parameters...
CVE-2023-30788: Improper Neutralization of Input During Web Page Generation
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the people/add endpoint and nickName, description, lastName, middleName and firstName parameter...
CVE-2023-30788
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the people/add endpoint and nickName, description, lastName, middleName and firstName parameter...
PT-2023-20814 · Churchcrm · Churchcrm
Name of the Vulnerable Software and Affected Versions: ChurchCRM version 4.5.3 Description: A cross-site request forgery CSRF issue allows attackers to edit information for existing people on the site. This means an attacker can trick a user into performing unintended actions on the site...
ChurchCRM 跨站请求伪造漏洞
ChurchCRM is an open source CRM system for churches. A security vulnerability exists in ChurchCRM version v4.5.3. An attacker exploiting this vulnerability could edit the information of existing people on the site...
CVE-2023-23973
Cross-Site Request Forgery CSRF vulnerability in a3rev Software Contact Us Page – Contact People plugin = 3.7.0...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in a3rev Software Contact Us Page – Contact People plugin = 3.7.0...
CVE-2023-23973 WordPress Contact Us page - Contact people LITE Plugin <= 3.7.0 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in a3rev Software Contact Us Page – Contact People plugin = 3.7.0...
CVE-2023-23973
CVE-2023-23973 affects the WordPress plugin “a3rev Software Contact Us Page – Contact People” (versions <= 3.7.0). The root cause is a CSRF weakness that allows creation and potentially manipulation of contact entries because no CSRF protection is present (unauthenticated access described in P...
CVE-2023-23973: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in a3rev Software Contact Us Page – Contact People plugin = 3.7.0...
How the US Can Stop Data Brokers' Worst Practices—Right Now
Legal experts say a key law should already prevent brokers from collecting and selling data that’s weaponized against vulnerable people...
Oracle PeopleSoft Enterprise PeopleTools 安全漏洞
Oracle PeopleSoft Enterprise PeopleTools is Oracle's technology for providing PeopleSoft applications with the ability to stay in sync with users' needs and expectations. A security vulnerability exists in PeopleSoft Enterprise CS Academic Advisement 9.2, which can be exploited by an attacker to...
Rapid7 Recognized as a Top Place to Work for 11th Consecutive Year
On November 30th, 2022, Rapid7 was again recognized by The Boston Globe as a Top Place to Work in Massachusetts. This marks the 11th consecutive year Rapid7 has made the list, this time coming in at 3 in the large company category. Top Places to Work rankings are based on a Globe survey that...
Reflecting on Cybersecurity Awareness Month: At its Core, Cybersecurity is all about People
As Cybersecurity Awareness Month 2022 comes to a close, I’m grateful for the impact it has had in bringing cybersecurity to the forefront since it began in 2004. Though the month may be over, our work in cybersecurity is never done. Often, we think about cybersecurity as a complex technology...