440 matches found
CVE-2023-4958
In Red Hat Advanced Cluster Security RHACS, it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptivel...
CVE-2023-4958 Stackrox: missing http security headers allows for clickjacking in web ui
In Red Hat Advanced Cluster Security RHACS, it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptivel...
CVE-2023-4958 Stackrox: missing http security headers allows for clickjacking in web ui
In Red Hat Advanced Cluster Security RHACS, it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptivel...
GD Security Headers < 1.7.1 - Admin+ SQLi
Description The plugin does not properly sanitise and escape the filter-vd and filter-ed parameters before using them in SQL statements, leading to SQL injections exploitable by high privilege users such as admin...
CVE-2023-46821
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Milan Petrovic GD Security Headers allows auth. admin+ SQL Injection.This issue affects GD Security Headers: from n/a through 1.7...
CVE-2023-46821
A vulnerability in Milan Petrovic GD Security Headers gd-security-headers.This issue affects GD Security Headers: from n/a through = 1.7...
CVE-2023-46821
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Milan Petrovic GD Security Headers allows auth. admin+ SQL Injection.This issue affects GD Security Headers: from n/a through 1.7...
Sql injection
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Milan Petrovic GD Security Headers allows auth. admin+ SQL Injection.This issue affects GD Security Headers: from n/a through 1.7...
CVE-2023-46821
GD Security Headers WordPress plugin
CVE-2023-46821 WordPress GD Security Headers Plugin <= 1.7 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Milan Petrovic GD Security Headers allows auth. admin+ SQL Injection.This issue affects GD Security Headers: from n/a through 1.7...
CVE-2023-46821 WordPress GD Security Headers Plugin <= 1.7 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Milan Petrovic GD Security Headers allows auth. admin+ SQL Injection.This issue affects GD Security Headers: from n/a through 1.7...
WordPress Plugin GD Security Headers SQL Injection Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
PT-2023-30236 · Unknown · Gd Security Headers
Name of the Vulnerable Software and Affected Versions: GD Security Headers versions 1.7 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows authorized users with admin+ privileges to...
WordPress GD Security Headers Plugin <= 1.7 is vulnerable to SQL Injection
Software GD Security Headers Type Plugin Vulnerable versions = 1.7 Fixed in 1.7.1 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-46821 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 9736788aaa7c Credits Muhammad Daffa Required privilege Administrator...
CVE-2023-41897
Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which specifies whether the web page is allowed to be framed. The omission of this and correlating headers facilitates covert clickjacking attacks...
CVE-2023-41897 Lack of XFO header allows clickjacking in Home Assistant Core
Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which specifies whether the web page is allowed to be framed. The omission of this and correlating headers facilitates covert clickjacking attacks...
PT-2023-28153
Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2023.9.0 Description The issue concerns the omission of HTTP security headers, including the X-Frame-Options header, in Home Assistant server. This omission facilitates covert clickjacking attacks and other...
CVE-2023-40330
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Milan Petrovic GD Security Headers plugin = 1.6.1 versions...