609 matches found
Cross site request forgery (csrf)
The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu...
CVE-2020-8417
The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu...
Malwinx - Just A Normal Flask Web App To Understand Win32Api With Code Snippets And References
A normal flask web app to learn win32api with code snippets and references. Prerequisite You need to download the following package before starting it pip install flask pip install pefile pip install requests Usage $ python flaskapp.py Live Demo Here is the Walkthrough: 1. Upload the exe or dll. ...
Open-Xchange: SSRF - Image Sources in HTML Snippets - 727234 bypass
This is about incomplete fix for my recent bug 727234. In short, the /ajax/snippet?action=import endpoint allows to create HTML snippets. URLs of images are extracted from HTML and their content is fetched and attached to created snippet. For more details please see 727234. With the fix applied,...
WordPress Woody Ad Snippets plugin <= 2.2.7 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability
Authenticated Reflected Cross-Site Scripting XSS vulnerability found in WordPress Woody Ad Snippets plugin versions = 2.2.7. Solution Update the WordPress Woody Ad Snippets plugin to the latest available version at least 2.2.8...
Woody Ad Snippets <= 2.2.8 - Authenticated Cross-Site Scripting (XSS)
The Woody ad snippets – Insert Header Footer Code, AdSense Ads WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
Exploit for Missing Authentication for Critical Function in Webcraftic Woody_Ad_Snippets
CVE-2019-15858 Unauthenticated Remote Code Execution at Wood...
WordPress Woody ad snippets Plugin < 2.2.5 Multiple Vulnerabilities
The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:webcraftic:woodyadsnippets"; ifdescription...
GitLab: Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests
I've found a three minor vulnerabilities which, when combined, allow an attacker to copy private repositories, confidential issues, private snippets, and then some. I'll go through the code path to explain the vulnerabilities and how they are combined. See the Proof of Concept section if you want...
WordPress Woody ad snippets plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Woody ad snippets is used in one of the pages to add ads to the plugin. A cross-site scripting vulnerability exists in the WordPress...
CVE-2019-15858
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution...
CVE-2019-15858
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution...
CVE-2019-15858
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution...
CVE-2019-15858
CVE-2019-15858 concerns the WordPress plugin Woody Ad Snippets (before 2.2.5). The vulnerability arises in admin/includes/class.import.snippet.php, where an unauthenticated options import function can be abused to store a payload, enabling cross‑site scripting and, in turn, remote code execution....
CVE-2018-20977
The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page...
PT-2019-10413 · WordPress · All-In-One-Schemaorg-Rich-Snippets
Name of the Vulnerable Software and Affected Versions: all-in-one-schemaorg-rich-snippets plugin versions prior to 1.5.0 Description: The issue concerns a cross-site scripting XSS flaw on the settings page. Recommendations: For versions prior to 1.5.0, update to version 1.5.0 or later to resolve...
WordPress Woody Ad Snippets Plugin < 2.2.6 File Deletion Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:webcraftic:woodyadsnippets"; if description...
WordPress Woody ad snippets plugin security feature issue vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Woody ad snippets is used in one of the pages to add ads to the plugin. The WordPress Woody ad snippets plugin has a security signature...
Woody Ad Snippets < 2.2.6 - Arbitrary Post Deletion
The adminInit function of the admin/includes/class.actions.snippets.php file, registered as an admininit hook did not have any CSRF or capability checks for its close action, allowing unauthenticated users to delete arbitrary posts from the blog...