2541 matches found
CVE-2015-9314
The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header...
Cross site request forgery (csrf)
The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header...
CVE-2015-9314
The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header...
CVE-2015-9314
The CVE-2015-9314 entry concerns the WordPress plugin NewStatPress, affected versions prior to 1.0.4. The vulnerability is an XSS issue tied to the Referer header, impacting the plugin’s handling of HTTP Referer data. Several connected sources corroborate the same flaw (XSS related to Referer hea...
CVE-2019-15062: Cross-Site Request Forgery (CSRF)
An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element containing a user/card.php CSRF request in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. The protection mechanism for CSRF is to check the Referer...
CVE-2015-9314: Improper Neutralization of Input During Web Page Generation
The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header...
PT-2019-7273
Name of the Vulnerable Software and Affected Versions newstatpress plugin versions prior to 1.0.4 for WordPress Description The issue is related to a Cross-Site Scripting XSS vulnerability. It is associated with the Referer header. Recommendations For versions prior to 1.0.4, update to version...
PT-2019-11768 · Jenkins · Jenkins Gitlab Authentication Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Gitlab Authentication Plugin version 1.4 and earlier Description: The issue allows attackers to redirect users to a URL outside Jenkins after a successful login, implementing an open redirect. This can be used by malicious sites to...
Open redirect vulnerability in gitlab-oauth
gitlab-oauth records the HTTP Referer header when the authentication process starts and redirects users to that URL when the user has finished logging in. This implements an open redirect, allowing malicious sites to implement a phishing attack, with users expecting they have just logged in to...
CVE-2019-6726
The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wppostratingsclearfastestcache and rmfolderrecursively in wpFastestCache.php mishandle ../ in an HTTP Referer header...
CVE-2019-6726
The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wppostratingsclearfastestcache and rmfolderrecursively in wpFastestCache.php mishandle ../ in an HTTP Referer header...
CVE-2019-6726
The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wppostratingsclearfastestcache and rmfolderrecursively in wpFastestCache.php mishandle ../ in an HTTP Referer header...
PT-2019-18286
Name of the Vulnerable Software and Affected Versions WP Fastest Cache plugin versions prior to 0.9.0 Description The issue allows remote attackers to delete arbitrary files due to mishandling of ../ in an HTTP Referer header by the wp postratings clear fastest cache and rm folder recursively...
CVE-2019-6726: Improper Limitation of a Pathname to a Restricted Directory
The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wppostratingsclearfastestcache and rmfolderrecursively in wpFastestCache.php mishandle ../ in an HTTP Referer header...
CVE-2017-17972
packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open Bug Bounty ID OBB-466362...
CVE-2017-17972
packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open Bug Bounty ID OBB-466362...
CVE-2017-17972: Improper Neutralization of Input During Web Page Generation
packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open Bug Bounty ID OBB-466362...
PT-2019-8253
Name of the Vulnerable Software and Affected Versions Archon version 3.21 rev-1 Description The issue concerns an XSS vulnerability in the referer parameter of an index.php?subjecttypeid=xxx request, specifically in the subjects.php file within the packages/subjects/pub directory. This...
LiveChat <= 3.7.2 - Unauthenticated Option Update/Reset and Stored XSS
The lack of proper CSRF and Authorisation checks could allow an unauthenticated attacker to update or reset the plugin's settings. Furthermore, when updating the livechatemail option, no sanitisation is performed, leading to a Stored XSS issue in the plugin's settings page. CSRF and XSS fixed in...