CVE-2023-49372

JFinalCMS v5.0.0 is affected by a Cross-Site Request Forgery (CSRF) vulnerability exploitable via the /admin/slide/save endpoint. Root cause is a CSRF weakness in that API path, as reported across multiple sources. CVSSv3.1 vector indicates high baseline impact (C/H, I/H, A/H) with no privileges ...

CVE-2023-49396

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/category/save...

UBUNTU-CVE-2023-40074

In saveToXml of PersistableBundle.java, invalid data could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

Download canvasio3D Light <= 2.5.0 - Subscriber+ Entries Update/Deletion

Description The plugin is vulnerable to unauthorized access & modification of data due to a missing capability check on the caARConnect function, allowing authenticated attackers, with subscriber-level access and above, to retrieve data from the plugin and save/delete entries...

Confluence XHR requests have the wrong content type

h3. Problem Watching or Stop watching a Confluence page and other operations see below list of identified endpoints will generate a request like the one below copied as curl from HAR capture for convenience: code:java curl 'https://confluence/rest/api/user/watch/content/9999999' \ -X 'DELETE' \ -...

CVE-2023-47844

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lim Kai Yang Grab & Save allows Reflected XSS.This issue affects Grab & Save: from n/a through 1.0.4...

CVE-2023-47844

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lim Kai Yang Grab & Save allows Reflected XSS.This issue affects Grab & Save: from n/a through 1.0.4...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lim Kai Yang Grab & Save allows Reflected XSS.This issue affects Grab & Save: from n/a through 1.0.4...

CVE-2023-47844

CVE-2023-47844 affects the WordPress plugin Grab & Save (versions

CVE-2023-47844 WordPress Grab & Save Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lim Kai Yang Grab & Save allows Reflected XSS.This issue affects Grab & Save: from n/a through 1.0.4...

WordPress Plugin Grab & Save Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Grab & Save <= 1.0.4 - Reflected Cross-Site Scripting

Description The Grab & Save plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

Grab & Save <= 1.0.4 - Cross-Site Request Forgery

Description The Grab & Save plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the mediaprocess function. This makes it possible for unauthenticated attackers to upload images via a forg...

PT-2023-22411 · Unknown · Sentrifugo

Name of the Vulnerable Software and Affected Versions: Sentrifugo version 3.5 Description: The issue allows an authenticated attacker to upload any file without extension filtering through the AssetsController::uploadsaveAction function. Recommendations: For Sentrifugo version 3.5, consider...

Image Hover Effects <= 5.5 - Cross-Site Request Forgery

Description The Image Hover Effects plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.5. This is due to missing or incorrect nonce validation on the savecaptionoptions function. This makes it possible for unauthenticated attackers to modify the...

CVE-2023-48109

Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the deviceId parameter in the function saveParentControlInfo . This vulnerability allows attackers to cause a Denial of Service DoS attack...

WordPress Grab & Save Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Grab & Save Type Plugin Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47844 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 52717b94fa86 Credits Dimas Maulana Required privilege...

Tenda AX1803 安全漏洞

Tenda AX1803 is a dual-band Gigabit WIFI6 router from Tenda China. A buffer overflow vulnerability exists in the Tenda AX1803 v1.0.0.1, which is caused by the urls parameter in the saveParentControlInfo function failing to correctly validate the length of the input data, and can be exploited by a...

WordPress Grab & Save Plugin <= 1.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Grab & Save Type Plugin Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-47845 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 10b2ddc4a429 Credits Dimas Maulana Required...

CVE-2023-47667 WordPress WP Full Stripe Free plugin <= 7.0.16 - Cross Site Request Forgery (CSRF) vulnerability on every Setting Save

Cross-Site Request Forgery CSRF vulnerability in Mammothology WP Full Stripe Free.This issue affects WP Full Stripe Free: from n/a through 7.0.16...