Cross site request forgery (csrf)

The Advanced Popups plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the metaboxpopupsave function. This makes it possible for unauthenticated attackers to save meta tags via a forged...

WordPress Plugin Advanced Popups 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

The case against self-closing tags in HTML

Let's talk about /: You'll see this syntax on my blog because it's what Prettier does, and I really like Prettier. However, I don't think / is a good thing. First up: The facts Enter XHTML Back in the late 90s and early 2000s, the W3C had a real thing for XML, and thought that it should replace...

GHSA-6PQF-C99P-758V org.xwiki.commons:xwiki-commons-xml's HTML sanitizer allows form elements in restricted

Impact The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishing attacks or also in the context of a sheet, the attacker could add ...

CVE-2023-36471 HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml

Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishi...

PT-2023-4819 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 14.6RC1 through 14.10.5 XWiki versions prior to 15.2RC1 Description: The issue arises from the HTML sanitizer in XWiki, which allowed form and input HTML tags since version 14.6RC1. This enables an attacker without script right...

The vulnerability of the Go programming language exists due to the lack of measures to neutralize special elements, allowing attackers to insert arbitrary attributes into HTML tags.

The vulnerability of the Go programming language exists because efforts have been made to eliminate special elements in non-quoted HTML attributes such as “attr=.”. Exploiting this vulnerability allows a malicious actor to insert arbitrary attributes into HTML tags from a remote location...

DRUPAL-CONTRIB-2023-026

This module enables you to use complex autocompletion in forms. The module doesn't sufficiently filter text in the data it exposes, allowing a malicious user to enter specially crafted tags to exploit a Cross Site Scripting XSS attack. This vulnerability is mitigated by the fact that an attacker...

WordPress Plugin Tags Cloud Manager Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Tags Cloud Manager, which is caused by improper validation of user-supplied...

PT-2023-7868

Name of the Vulnerable Software and Affected Versions Microsoft Edge affected versions not specified Description The issue is related to a security feature bypass in Microsoft Edge, allowing a remote attacker to bypass security restrictions by loading a malicious web page or file. This is due to...

CVE-2023-34466

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, tags from pages not viewable to the current user are leaked by the tags API. This information can also...

Information disclosure

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, tags from pages not viewable to the current user are leaked by the tags API. This information can also...

CVE-2023-34466 XWiki Platform's tags on non-viewable pages can be revealed to users

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, tags from pages not viewable to the current user are leaked by the tags API. This information can also...

CVE-2023-34466 XWiki Platform's tags on non-viewable pages can be revealed to users

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, tags from pages not viewable to the current user are leaked by the tags API. This information can also...

CVE-2023-34466 XWiki Platform's tags on non-viewable pages can be revealed to users

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, tags from pages not viewable to the current user are leaked by the tags API. This information can also...

CVE-2023-28166

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Aakif Kadiwala Tags Cloud Manager plugin = 1.0.0 versions...

CVE-2023-28166

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Aakif Kadiwala Tags Cloud Manager plugin = 1.0.0 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Aakif Kadiwala Tags Cloud Manager plugin = 1.0.0 versions...

CVE-2023-28166

CVE-2023-28166 affects the WordPress plugin Tags Cloud Manager (versions ≤ 1.0.0). It is an unauthenticated, reflected XSS vulnerability caused by improper validation of user input. Exploitation could lead to script execution in a victim’s browser. Remediation: update to a version later than 1.0....

CVE-2023-28166 WordPress Tags Cloud Manager Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Aakif Kadiwala Tags Cloud Manager plugin = 1.0.0 versions...