Discourse 3.1.x < 3.1.0.beta3 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescriptio...

CVE-2023-23935

Discourse (open-source messaging platform) contains a tag-count leakage vulnerability. In versions up to 3.0.1 on stable and up to 3.1.0.beta2 on beta/tests-passed, the count displayed for a tag sums all personal messages regardless of user visibility. This allows users to infer whether a sensiti...

Discourse 信息泄露漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, e-mail and chat rooms. Discourse suffers from an information disclosure vulnerability that stems from the fact that any user can technically poll sensitive tags to determine if a new...

DEBIAN-CVE-2020-27507

The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact...

PT-2023-11761 · Unknown +2 · Kamailio Sip +2

Name of the Vulnerable Software and Affected Versions: Kamailio SIP versions prior to 5.5.0 Description: The issue is related to the mishandling of INVITE requests with duplicated fields and overlength tags by the Kamailio SIP server, leading to a buffer overflow. This can cause the server to cra...

xili-tidy-tags <= 1.12.03 - Cross-Site Request Forgery

The plugin does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks. The original researcher didn't provide enough information on which actions could be performed...

Tags Cloud Manager <= 1.0.0 - Reflected XSS

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against ??? high privilege users such as admin|only unauthenticated users...

WordPress Tags Cloud Manager Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Tags Cloud Manager Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28166 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 2ce2846850ca Credits Nithissh S Required...

WordPress xili-tidy-tags Plugin <= 1.12.03 is vulnerable to Cross Site Request Forgery (CSRF)

Software xili-tidy-tags Type Plugin Vulnerable versions = 1.12.03 Fixed in 1.12.04 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47448 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9198c2b96cd1 Credits rezaduty Require...

WordPress Mass Delete Unused Tags Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Mass Delete Unused Tags Type Plugin Vulnerable versions = 2.0.0 Fixed in 3.0.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27430 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 6d6176635537 Credits Mika Requir...

Nextcloud: Users can set up workflows using restricted and invisible system tags

Vulnerability description not provided...

Design/Logic Flaw

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in UBIT Information Technologies Student Information Management System.This issue affects Student Information Management System: before 20211126...

CVE-2021-44197 XSS in UBIT Information Technologies Student Information Management System

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in UBIT Information Technologies Student Information Management System. This issue affects Student Information Management System: before 20211126...

PT-2023-12533 · Ubit Information Technologies · Ubit Information Technologies Student Information Management System

Name of the Vulnerable Software and Affected Versions: UBIT Information Technologies Student Information Management System versions before 20211126 Description: The issue is related to Improper Neutralization of Script-Related HTML Tags in a Web Page, also known as Basic XSS. This allows for...

CVE-2023-27472

quickentity-editor-next is an open source, system local, video game asset editor. In affected versions HTML tags in entity names are not sanitised XSS vulnerability. Allows arbitrary code execution within the browser sandbox, among other things, simply from loading a file containing a script tag ...

CVE-2023-27472 HTML tags in entity names in the tree view are not sanitised in quickentity-editor-next

quickentity-editor-next is an open source, system local, video game asset editor. In affected versions HTML tags in entity names are not sanitised XSS vulnerability. Allows arbitrary code execution within the browser sandbox, among other things, simply from loading a file containing a script tag ...

CVE-2023-27472

The CVE-2023-27472 issue affects quickentity-editor-next. It arises because HTML tags in entity names are not sanitized, enabling XSS and potentially arbitrary code execution within the browser sandbox simply by loading a file containing a script tag in an entity name. The vulnerability is mitiga...

PT-2023-21150 · Unknown · Quickentity-Editor-Next

Name of the Vulnerable Software and Affected Versions: quickentity-editor-next versions prior to 1.28.1 Description: The issue concerns an open source, system local, video game asset editor. In affected versions, HTML tags in entity names are not sanitized, leading to an XSS vulnerability. This...

Saysis Computer Starcities 跨站脚本漏洞

Saysis Computer Starcities is an open source automation system. A cross-site scripting vulnerability exists in Saysis Computer Starcities versions prior to 1.1 that stems from improperly neutralized script-related HTML tags in a web page and a cross-site scripting XSS vulnerability...

CVE-2023-25819 Discourse tags with no visibility are leaking into og:article:tag

Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the tests-passed or beta branches = 3.1.0.beta2. The issue is patched in the latest beta and tests-passed version of Discourse...