4994 matches found
starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
Summary A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. Details Here's the offending line:...
Exploit for Improper Privilege Management in Nzxt Cam
poc-for-CVE-2020-13519-still-under-construc...
Authorization Bypass Through User-Controlled Key
Overview aimeos/ai-controller-frontend is an Aimeos business controller logic for frontend Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the account profile page. An attacker can manipulate account details and disable subscriptions an...
Book Review Library 安全漏洞
Book Review Library is a simple book review library by Shubham Singh, a personal developer. A security vulnerability exists in Book Review Library version 1.0 that originates from user interaction with a carefully constructed password reset link, allowing an attacker to obtain a password reset...
PT-2024-31867 · Unknown · Bookreviewlibrary
Name of the Vulnerable Software and Affected Versions: BookReviewLibrary version 1.0 Description: A host header injection issue allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This is achieved through manipulating the host header, which...
CVE-2024-20433
creationtimestamp| type| source ---|---|--- 2024-09-25 20:13:28+00:00| seen| https://t.me/cvedetector/6352 2025-01-04 23:04:57+00:00| seen| https://www.jerrygamblin.com/2025/01/05/2024-cve-data-review/ 2025-01-04 23:04:57+00:00| seen| https://www.jerrygamblin.com/2025/01/05/2024-cve-data-review/...
WordPress Review & testimonial widgets plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by theviper17 Patchstack Alliance in WordPress Plugin Review & testimonial widgets versions = 1.0.5...
WordPress Review & testimonial widgets Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)
Software Review & testimonial widgets Type Plugin Vulnerable versions = 1.0.5 Fixed in 1.0.10 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44022 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b905151529cd Credits theviper17 Required...
CVE-2024-8052
The Review Ratings WordPress plugin through 1.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
CVE-2024-8052 Review Ratings <= 1.6 - Stored XSS via CSRF
The Review Ratings WordPress plugin through 1.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
CVE-2024-8052
CVE-2024-8052 affects the Review Ratings WordPress plugin (versions ≤ 1.6). The vulnerability enables a Stored XSS via a CSRF flaw caused by missing CSRF checks and insufficient sanitisation/escaping in multiple areas. If a logged-in admin user performs actions triggering these endpoints, an atta...
WordPress plugin Review Ratings 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in WordPres...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the QuillJS WYSWYG editor in the admin panel, by modifying an HTML file before being uploaded to the server. Workaround Users who are not able to upgrade to the fixed version can: 1 Review the user...
UBUNTU-CVE-2024-46685
In the Linux kernel, the following vulnerability has been resolved: pinctrl: single: fix potential NULL dereference in pcsgetfunction pinmuxgenericgetfunction can return NULL and the pointer 'function' was dereferenced without checking against NULL. Add checking of pointer 'function' in...
CVE-2024-46685
CVE-2024-46685 is a Linux kernel vulnerability involving the pinctrl/pinmux subsystem. The issue was a potential NULL dereference: pinmux_generic_get_function() could return NULL and PCS_get_function() dereferenced the pointer without NULL-checks. The fix adds a NULL check for the function pointe...
CVE-2024-46685 pinctrl: single: fix potential NULL dereference in pcs_get_function()
In the Linux kernel, the following vulnerability has been resolved: pinctrl: single: fix potential NULL dereference in pcsgetfunction pinmuxgenericgetfunction can return NULL and the pointer 'function' was dereferenced without checking against NULL. Add checking of pointer 'function' in...
CVE-2024-46685 pinctrl: single: fix potential NULL dereference in pcs_get_function()
In the Linux kernel, the following vulnerability has been resolved: pinctrl: single: fix potential NULL dereference in pcsgetfunction pinmuxgenericgetfunction can return NULL and the pointer 'function' was dereferenced without checking against NULL. Add checking of pointer 'function' in...
Developers Beware: Lazarus Group Uses Fake Coding Tests to Spread Malware
Cybersecurity researchers have uncovered a new set of malicious Python packages that target software developers under the guise of coding assessments. "The new samples were tracked to GitHub projects that have been linked to previous, targeted attacks in which developers are lured using fake job...
PT-2024-39179 · Unknown · Tduckcloud Tduckpro
Name of the Vulnerable Software and Affected Versions: TDuckCloud TDuckPro versions up to 6.3 Description: A critical vulnerability was found in TDuckCloud TDuckPro, affecting an unknown functionality. The manipulation leads to weak password recovery, and the attack can be launched remotely. The...