8895 matches found
CVE-2023-6250
The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag...
CVE-2023-6250
The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag...
Design/Logic Flaw
The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag...
CVE-2023-6250 BestWebSoft's Like & Share < 2.74 - Unauthenticated Password Protected Post Read
The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag...
PT-2023-31271 · Growi · Growi
Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.0 Description: A stored cross-site scripting issue exists in the event handlers of the pre tags. If exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the...
PT-2023-32576 · Bestwebsoft · Like & Share
Name of the Vulnerable Software and Affected Versions: BestWebSoft's Like & Share WordPress plugin versions prior to 2.74 Description: The issue allows unauthenticated users to access the content of password-protected posts via a meta tag. Recommendations: For versions prior to 2.74, update to...
PT-2023-31348 · Growi · Growi
Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.0 Description: A stored cross-site scripting issue exists in the anchor tag of GROWI. If exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...
Weseek GROWI Cross-Site Scripting Vulnerability
Weseek GROWI is a team collaboration software from Weseek Japan. A cross-site scripting vulnerability exists in Weseek GROWI versions prior to v6.0.0, which originates from cross-site scripting in the anchor tag and can be exploited by an attacker to execute arbitrary script on a user's web brows...
Fedora 38 : mingw-gstreamer1 / mingw-gstreamer1-plugins-bad-free / etc (2023-0984b63b23)
The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-0984b63b23 advisory. Update to 1.22.7, fixes CVE-2023-37327, CVE-2023-37328, CVE-2023-37329. Tenable has extracted the preceding description block directly from the Fedo...
MP3Gain Security Breach
MP3Gain is an audio volume control application. A security vulnerability exists in MP3Gain v1.6.2, which originated from allowing an attacker to cause a denial of service via the WriteMP3GainAPETag function...
CVE-2023-49356
A stack buffer overflow vulnerability in MP3Gain v1.6.2 allows an attacker to cause a denial of service via the WriteMP3GainAPETag function at apetag.c:592...
CVE-2023-28025
Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed a...
Cross site scripting
Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed a...
CVE-2023-28025
CVE-2023-28025 affects HCL Technologies BigFix Mobile / Modern Client Management (including v3.1 and prior per multiple sources). The issue is a stored XSS via the ability to inject an SVG tag into HTML, resulting in an alert cookie pop-up. Root cause is improper input handling that allows SVG ma...
CVE-2023-28025 An HTML injection vulnerability can affect HCL BigFix Mobile / Modern Client Management
Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed a...
The vulnerability of Microsoft Edge browsers lies in the lack of tag blocking during website loading, which allows attackers to circumvent security restrictions.
The vulnerability of Microsoft Edge relates to the absence of tag blocking during website loading. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions by loading malicious web pages or files...
PT-2023-21490 · Hcl +1 · Hcl Bigfix Mobile / Modern Client Management +1
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows a Master operator to potentially incorporate an SVG tag into HTML, leading to an alert pop-up that displays a cookie. This is related t...
Updated cjose packages fix a security vulnerability
The updated packages fix a security vulnerability: The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated...
MGASA-2023-0350 Updated cjose packages fix a security vulnerability
The updated packages fix a security vulnerability: The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated...
CVE-2023-6051
An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when source code or installation packages are pulled from a specific tag...