716 matches found
Wordpress Plugin All-in-one Floating Contact Form 跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. wordpress Plugin All-in-one Floating Contact Form...
CVE-2021-24992
The CVE-2021-24992 issue affects the WordPress Buttonizer (Smart Floating / Sticky Buttons) plugin for WordPress, prior to version 2.5.5. The root cause is failure to sanitise and escape certain parameters before outputting them in HTML attributes and pages, enabling stored Cross-Site Scripting b...
WordPress Catch Sticky Menu plugin <= 1.6.3 - Unauthorized Plugin Setting Change vulnerability
Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress Catch Sticky Menu plugin versions = 1.6.3. Solution Update the WordPress Catch Sticky Menu plugin to the latest available version at least 1.7...
WordPress Sticky Related Posts <= 1.0 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress Sticky Related Posts versions = 1.0. Solution This plugin has been closed as of January 28, 2021 and is not available for download. This closure is permanent. Reason: Author Request...
Security Bulletin: IBM Spectrum Protect Plus has Insecure File Permissions due to not setting the Sticky Bit (CVE-2021-20490)
Summary IBM Spectrum Protect Plus has several directories that are failing security scans due to the sticky bit not being set on world-writable files. Vulnerability Details CVEID: CVE-2021-20490 DESCRIPTION: IBM Spectrum Protect Plus could allow a local user to cause a denial of service due to...
Sticky Notes Widget 3.0.6 Denial Of Service
Exploit Title: Sticky Notes Widget Version 3.0.6 - Denial of Service PoC Date: 06-07-2021 Author: Geovanni Ruiz Download Link: https://apps.apple.com/us/app/sticky-notes-widget/id1499269608 Version: 3.0.6 Category: DoS iOS Vulnerability Color Notes is vulnerable to a DoS condition when a long lis...
CVE-2021-29428
In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Gradle builds could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreatin...
DEBIAN-CVE-2021-29428
In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Gradle builds could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreatin...
CVE-2021-29428
In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Gradle builds could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreatin...
UBUNTU-CVE-2021-29428
In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Gradle builds could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreatin...
CVE-2021-29428 Local privilege escalation through system temporary directory
In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Gradle builds could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreatin...
PT-2021-18204 · Gradle +2 · Gradle +2
Name of the Vulnerable Software and Affected Versions: Gradle versions prior to 7.0 Description: The issue affects Gradle builds on Unix-like systems, where the system temporary directory can be created with open permissions, allowing multiple users to create and delete files within it. This can...
SYS.2.3.A7
Es SOLLTE sichergestellt werden, dass Dienste und Anwendungen nur die ihnen zugeordneten Dateien erstellen, veraendern oder loeschen duerfen. Auf Verzeichnissen, in denen alle Benutzer Schreibrechte haben z. B. /tmp, SOLLTE das Sticky Bit gesetzt werden. SPDX-FileCopyrightText: 2021 Greenbone AG...
Sticky Notes Apps Using JavaScript 1.0 Cross Site Scripting
Exploit Title: Sticky Note Apps using JavaScript | Stored Cross Site Scripting Exploit Author: Richard Jones Date: 2021-03-09 Vendor Homepage: https://www.sourcecodester.com/javascript/14742/sticky-note-apps-using-javascript-source-code.html Software Link:...
Cross-site Scripting (XSS)
flarum/sticky is vulnerable to cross-site scripting. An attacker with the ability to pin their own discussion, or be able to edit a discussion that was previously pinned is able to inject and execute an arbitrary script via Mithril's m.trust helper while the extension is enabled...
XSS in Flarum Sticky extension
Impact A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to be injected as HTML on the discussion list. The issue was discovered following an internal audit. Any HTML would be injected through Mithril's m.trust helper. This...
GHSA-H3GG-7WX2-CQ3H XSS in Flarum Sticky extension
Impact A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to be injected as HTML on the discussion list. The issue was discovered following an internal audit. Any HTML would be injected through Mithril's m.trust helper. This...
CVE-2021-21283
Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to...
CVE-2021-21283
Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to...
Cross site scripting
Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to...