5861 matches found
CVE-2023-37528: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of the Save Report...
CVE-2023-44031: Improper Access Control
Incorrect access control in Reprise License Management Software Reprise License Manager v15.1 allows attackers to arbitrarily save sensitive files in insecure locations via a crafted POST request...
PT-2024-12632 · Hcl · Hcl Bigfix Platform
Name of the Vulnerable Software and Affected Versions: HCL BigFix Platform affected versions not specified Description: A cross-site scripting XSS vulnerability in the Web Reports component can possibly allow an attack to exploit an application parameter during execution of the Save Report...
CVE-2023-36260
An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service DoS via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about cod...
InstaWP Connect Plugin Data Access
The vulnerability of the savemanagementsettings function in the InstaWP Connect plugin of the WordPress content management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain read, edit, or delete access to data...
Motorola MR2600 Command Injection Vulnerability
The Motorola MR2600 is a wireless router from Motorola, Inc. A security vulnerability exists in the Motorola MR2600 due to a command injection vulnerability in the "SaveSysLogParams" parameter...
CVE-2024-0617
The Category Discount Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpcdsavediscount function in all versions up to, and including, 4.12. This makes it possible for unauthenticated attackers to modify product category...
WordPress plugin Category Discount Woocommerce Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
PT-2024-15693 · WordPress · Category Discount Woocommerce
Name of the Vulnerable Software and Affected Versions: Category Discount Woocommerce plugin for WordPress versions up to, and including, 4.12 Description: The issue arises from a missing capability check on the wpcd save discount function, allowing unauthenticated attackers to modify product...
Advanced Page Visit Counter <= 8.0.6 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Visit the "Settings" interface...
WolfNet IDX for WordPress <= 1.19.1 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. In the settings of the plugin, ente...
CVE-2024-22601
FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerability via /system/score/scorerulesave...
CVE-2024-22818
FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerbility via /system/site/filterKeywordsave...
CVE-2024-22699
FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerability via /system/admin/updategroupsave...
CVE-2024-22591
FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerability via /system/user/groupsave...
CVE-2024-22593
FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerability via /system/admin/addgroupsave...
FlyCms Security Vulnerability
sunkaifei FlyCms is sunkaifei open source application . A similar to Zhihu to Q&A based on the fully open source JAVA language development of social networking site builder . FlyCms security vulnerabilities , the vulnerability stems from /system/user/groupsave location cross-site request forgery...
PT-2024-19498 · Flycms · Flycms
Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. It occurs via the "/system/admin/add group save" API endpoint. This allows for potentially unauthorized actions to be performed on behalf of an...
PT-2024-19496 · Flycms · Flycms
Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. It can be exploited via the /system/user/group save API endpoint. Recommendations: For FlyCms version 1.0, as a temporary workaround, consider...
