Input validation

Improper Input Validation in the hyperlink interpretation in Savoir-faire Linux's Jami version 20222284 on Windows. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenger...

CVE-2023-3434 QRC Handler without Input Validation in Jami

Improper Input Validation in the hyperlink interpretation in Savoir-faire Linux's Jami version 20222284 on Windows. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenger...

PT-2023-32994 · Unknown · Pocketmine

Name of the Vulnerable Software and Affected Versions: PocketMine versions prior to 4.22.3 PocketMine versions prior to 5.2.1 Description: A player can cause the server to crash by sending a packet with incorrect sign data in NBT in the BlockActorDataPacket. This can be achieved by sending an NBT...

cjose 加密问题漏洞

Cisco cjose is a C library from Cisco that implements Javascript Object Signing and Encryption JOSE. A cryptographic issue vulnerability exists in cjose that stems from the AES GCM decryption routines incorrectly using the length of the tag in the actual authentication tag provided in JWE...

Google Android Automotive OS 访问控制错误漏洞

Google Android Automotive OS is an operating system and platform from Google Inc. that runs directly on in-vehicle hardware. Google Android Automotive OS suffers from a security vulnerability that stems from a notification access rights dialog where a malicious application can embed a very long...

CVE-2023-28995

Cross-Site Request Forgery CSRF vulnerability in Keith Solomon Configurable Tag Cloud CTC plugin = 5.2 versions...

CVE-2023-28995

Cross-Site Request Forgery CSRF vulnerability in Keith Solomon Configurable Tag Cloud CTC plugin = 5.2 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Keith Solomon Configurable Tag Cloud CTC plugin = 5.2 versions...

CVE-2023-28995

CVE-2023-28995 is a CSRF in the WordPress plugin Configurable Tag Cloud (CTC) , affecting versions ≤ 5.2. The root cause is described as CSRF via the ctc_options_page() entry point, enabling unauthenticated actions on vulnerable sites. Patch/mitigation: update to version 5.3 or later (as indicate...

CVE-2023-28995 WordPress Configurable Tag Cloud Plugin <= 5.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Keith Solomon Configurable Tag Cloud CTC plugin = 5.2 versions...

CVE-2023-28995 WordPress Configurable Tag Cloud Plugin <= 5.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Keith Solomon Configurable Tag Cloud CTC plugin = 5.2 versions...

Wrodpress Plugin Configurable Tag Cloud 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

PT-2023-22072 · Unknown · Keith Solomon Configurable Tag Cloud (Ctc) Plugin

Name of the Vulnerable Software and Affected Versions: Keith Solomon Configurable Tag Cloud CTC plugin versions = 5.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a...

CVE-2023-36995

TravianZ through 8.3.4 allows XSS via the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie...

CVE-2023-36995

TravianZ through 8.3.4 allows XSS via the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie...

attackers with role "USER" can create tags

Description It seems that the users with role ""USER" has no permission with creating tags, but we do not enforce it. Ohers operation, like edit and delete has no problem. Proof of Concept pull the latest docker and setup answer 1 create a user with name "normaluser", whose role is "USER" 2 admin...

CVE-2023-21183

In ForegroundUtils of ForegroundUtils.java, there is a possible way to read NFC tag data while the app is still in the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

Design/Logic Flaw

In ForegroundUtils of ForegroundUtils.java, there is a possible way to read NFC tag data while the app is still in the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

PT-2023-17971 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: A logic error in the ForegroundUtils.java code allows for the potential reading of NFC tag data even when the app is in the background. This issue could lead to local escalation of privilege without...

CVE-2023-21183

In ForegroundUtils of ForegroundUtils.java, there is a possible way to read NFC tag data while the app is still in the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...