CVE-2023-24060

Haven 5d15944 allows Server-Side Request Forgery SSRF via the feedurl= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname or even the hostname of the Haven server itself. NOTE: this product has significant usage but...

CVE-2023-24060

Haven 5d15944 allows Server-Side Request Forgery SSRF via the feedurl= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname or even the hostname of the Haven server itself. NOTE: this product has significant usage but...

CVE-2023-24060

Haven 5d15944 contains a Server-Side Request Forgery (SSRF) in the feed[url] Feeds functionality. An authenticated user who can create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname (including the Haven server’s own hostname). The vulnerability description does not specify an aff...

CVE-2023-22724

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

Cross site scripting

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

UBUNTU-CVE-2023-22724

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

GLPI 跨站脚本漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

CVE-2023-22724

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

CVE-2023-22724 glpi contains XSS in RSS Description Link

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

CVE-2023-22724

GLPI is affected by CVE-2023-22724: versions prior to 10.0.6 are vulnerable to Cross-site Scripting via malicious RSS feeds imported by an administrator. Visiting RSS content with a crafted link can execute JavaScript in a user’s browser. The flaw is mitigated by upgrading to 10.0.6 or newer, per...

CVE-2023-22724 glpi contains XSS in RSS Description Link

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

CVE-2023-22724 glpi contains XSS in RSS Description Link

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

WordPress Category Specific RSS feed Subscription Plugin <= v2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Category Specific RSS feed Subscription Type Plugin Vulnerable versions = v2.1 Fixed in v2.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-22691 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID aed3a951c25f Credi...

PT-2023-33349 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.227 Description: The issue is related to an out of bounds read in the mvneta config rss function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versio...

CVE-2023-22493

RSSHub (Node.js) is affected by a Server-Side Request Forgery (SSRF) vulnerability caused by unsafe route parameter handling. An attacker can induce the server to issue arbitrary HTTP requests, potentially accessing internal resources. The issue is mitigated by patch commit a66cbcf in RSSHub, and...

PT-2023-18544 · Rsshub · Rsshub

Name of the Vulnerable Software and Affected Versions: RSSHub affected versions not specified Description: RSSHub is an open source RSS feed generator that is vulnerable to Server-Side Request Forgery SSRF attacks. This issue allows an attacker to send arbitrary HTTP requests from the server to...

TTRSS-Auth-LDAP 注入漏洞

TTRSS-Auth-LDAP is a GitHub repository for the authldap plugin for Tiny Tiny RSS from the individual developer Ben Tyger. An injection vulnerability exists in TTRSS-Auth-LDAP. An attacker could exploit this vulnerability to cause LDAP injection...

WordPress RSS Feed Retriever Plugin <= 1.6.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software RSS Feed Retriever Type Plugin Vulnerable versions = 1.6.7 Fixed in 1.6.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 3.1 Developer Claim ownership PSID de28d2cfcddb Credits N/A Required privilege...

RSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. 1. Add the Feedzy RS...

WordPress RSS Feed Retriever Plugin <= 1.6.7 is vulnerable to Broken Access Control

Software RSS Feed Retriever Type Plugin Vulnerable versions = 1.6.7 Fixed in 1.6.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 7b026c8a46c6 Credits N/A Required privilege...