974 matches found
PT-2023-32354 · WordPress · Thumbnail Carousel Slider Plugin
Name of the Vulnerable Software and Affected Versions: Thumbnail carousel slider plugin for WordPress version 1.0 Description: The issue is due to missing nonce validation on the deleteselected function, making it possible for unauthenticated attackers to delete sliders in bulk via a forged reque...
PT-2023-32353 · WordPress · Thumbnail Slider With Lightbox
Name of the Vulnerable Software and Affected Versions: The Thumbnail Slider With Lightbox plugin for WordPress version 1.0 Description: The issue is due to missing or incorrect nonce validation on the addedit functionality. This allows unauthenticated attackers to upload arbitrary files via a...
WordPress Thumbnail Slider With Lightbox Plugin <= 1.0 is vulnerable to Arbitrary File Upload
Software Thumbnail Slider With Lightbox Type Plugin Vulnerable versions = 1.0 Fixed in 1.0.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-5820 Patch priority Low CVSS severity Low 10 Developer Claim ownership PSID 5ea4464f8b32 Credits Ala Arfaoui Required privilege...
WordPress Thumbnail carousel slider Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)
Software Thumbnail carousel slider Type Plugin Vulnerable versions = 1.0 Fixed in 1.0.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-5821 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9f54b1a63e12 Credits Ala Arfaoui...
CVE-2023-5621 Thumbnail Slider With Lightbox <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Image Title
The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress Thumbnail Slider With Lightbox Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Software Thumbnail Slider With Lightbox Type Plugin Vulnerable versions = 1.0 Fixed in 1.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5621 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 59e46e4028d4 Credits Ala Arfaoui...
WordPress Plugin Thumbnail Slider With Lightbox Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...
Arbitrary File Upload
concrete5/concrete5 is vulnerable to Arbitrary File Upload. The vulnerability exists due to the lack of sanitization in the Thumbnail file upload section, which allows an attacker to upload maliciously crafted PDF, SVG, or HTML files, potentially leading to Cross-Site Scripting XSS attacks...
CVE-2023-5531
The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the delete functionality. This makes it possible for unauthenticated attackers to delete image...
Cross site request forgery (csrf)
The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the delete functionality. This makes it possible for unauthenticated attackers to delete image...
CVE-2023-5531
The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the delete functionality. This makes it possible for unauthenticated attackers to delete image...
WordPress Thumbnail Slider With Lightbox Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)
Software Thumbnail Slider With Lightbox Type Plugin Vulnerable versions = 1.0 Fixed in 1.0.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-5531 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fe76aeae2c6a Credits Ala...
GHSA-WRP2-6V6J-HFMG ConcreteCMS vulnerable to Stored Cross-site Scripting
Concrete CMS v9.2.1 is affected by Arbitrary File Upload vulnerability via the Thumbnail file upload, which allows Cross-Site Scripting XSS...
CVE-2023-44763
Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting XSS. NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file types, even though pdf is one of the...
Cross site scripting
DISPUTED Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting XSS. NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file types, even though pdf is o...
PT-2023-29287 · Unknown · Concrete Cms
Name of the Vulnerable Software and Affected Versions: Concrete CMS version 9.2.1 Description: The issue allows for Arbitrary File Upload via a Thumbnail file upload, which can lead to Cross-Site Scripting XSS. This is possible even with the default configuration, where 'pdf' is one of the allowe...
CVE-2023-44763
Summary: Concrete CMS v9.2.1 is affected by an arbitrary file upload vulnerability via the Thumbnail upload, enabling Cross-Site Scripting (XSS). The issue stems from insufficient validation/sanitization of uploaded files, allowing malicious content to be stored/executed. Several connected source...
CVE-2023-4616
This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/thumbnail endpoint. The issue results from the lack of proper validati...
Fedora: Security Advisory for ImageMagick (FEDORA-2023-edbdccae2a)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
