WordPress Stock market charts from finviz Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Stock market charts from finviz Type Plugin Vulnerable versions = 1.0.1 Fixed in 1.0.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23809 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 206bbc36367f Credits Rio...

WordPress Real Estate 7 Theme <= 3.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Real Estate 7 Type Theme Vulnerable versions = 3.3.1 Fixed in 3.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-47146 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c7f26312f6a1 Credits RE-ALTER Required...

WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)

Software ProfilePress Type Plugin Vulnerable versions = 4.5.4 Fixed in 4.5.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23820 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1dded0badc30 Credits Rafie Muhammad Patchstack...

WordPress Theme Tweaker Plugin <= 5.20 is vulnerable to Cross Site Request Forgery (CSRF)

Software Theme Tweaker Type Plugin Vulnerable versions = 5.20 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23713 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6e1a4c281d2a Credits Mika Required privilege...

WordPress WP Dynamic Keywords Injector Plugin <= 2.3.15 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Dynamic Keywords Injector Type Plugin Vulnerable versions = 2.3.15 Fixed in 2.3.16 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47141 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID c2248ca9d15a Credits...

WordPress CSS JS Manager Plugin <= 2.4.49 is vulnerable to Cross Site Request Forgery (CSRF)

Software CSS JS Manager Type Plugin Vulnerable versions = 2.4.49 Fixed in 2.4.49.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47154 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d901e9767d13 Credits rezaduty Require...

tech-top-eng.com Cross Site Scripting vulnerability OBB-3196751

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Quiz And Survey Master Plugin <= 8.0.8 is vulnerable to Arbitrary Content Deletion

Software Quiz And Survey Master Type Plugin Vulnerable versions = 8.0.8 Fixed in 8.0.9 OWASP Top 10 A5: Broken Access Control Classification Arbitrary Content Deletion CVE CVE-2023-0291 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 5e9a3307d184 Credits Julien Ahrens...

WordPress Simple PDF Viewer Plugin <= 1.9 is vulnerable to Cross Site Scripting (XSS)

Software Simple PDF Viewer Type Plugin Vulnerable versions = 1.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23817 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 65a3708bedaf Credits István Márton Required...

WordPress Portfolio Slideshow Plugin <= 1.13.0 is vulnerable to Cross Site Scripting (XSS)

Software Portfolio Slideshow Type Plugin Vulnerable versions = 1.13.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23717 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 06802f1d0214 Credits István Márton Requir...

WordPress Zeno Font Resizer Plugin <= 1.7.9 is vulnerable to Cross Site Scripting (XSS)

Software Zeno Font Resizer Type Plugin Vulnerable versions = 1.7.9 Fixed in 1.8.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25442 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9818bffc879d Credits Rio Darmawan Required...

QVidium Technologies Amino A140 命令注入漏洞

The QVidium Technologies Amino A140 is a HD IPTV/OTT set-top box from QVidium Technologies. A security vulnerability exists in the QVidium Technologies Amino A140 versions prior to firmware version 1.0.0-283 that originates from a command injection in the web management interface of older QVidium...

WordPress Campaign URL Builder Plugin <= 1.8.1 is vulnerable to Cross Site Scripting (XSS)

Software Campaign URL Builder Type Plugin Vulnerable versions = 1.8.1 Fixed in 1.8.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 0afec8be8763 Credits WordFence Required privilege...

WordPress Scriptless Social Sharing Plugin < 3.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Scriptless Social Sharing Type Plugin Vulnerable versions 3.2.2 Fixed in 3.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0377 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID ac2027e820d0 Credits Lana Codes...

PT-2023-18563 · Sequelize +1 · Sequelize +1

Name of the Vulnerable Software and Affected Versions: Sequelize versions prior to 6.28.1 Sequelize Core versions prior to 7.0.0.alpha-20 Description: The issue is due to improper parameter filtering in the Sequelize JS library, which can allow an attacker to perform injection. Providing an inval...

SUSE CVE-2011-3640

Untrusted search path vulnerability in Mozilla Network Security Services NSS, as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was "Strange behavior, but...

SUSE CVE-2011-4681

Opera before 11.60 does not properly consider the number of . dot characters that conventionally exist in domain names of different top-level domains, which allows remote attackers to bypass the Same Origin Policy by leveraging access to a different domain name in the same top-level domain, as...

SUSE CVE-2012-3994

Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allow remote attackers to conduct cross-site scripting XSS attacks via a binary plugin that uses Object.defineProperty to shadow the top object, and...

SUSE CVE-2012-4209

Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 do not prevent use of a "top" frame name-attribute value to access the location property, which makes it easier for remote attackers to conduct...

SUSE CVE-2013-1698

The getUserMedia permission implementation in Mozilla Firefox before 22.0 references the URL of a top-level document instead of the URL of a specific page, which makes it easier for remote attackers to trick users into permitting camera or microphone access via a crafted web site that uses IFRAME...