72 matches found
Moodle 安全漏洞
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from a cross-site request forgery vulnerability that stems from incorrect CSRF token checking, which can be exploited by...
WordPress plugin Shortcodes and extra features for Phlox theme 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability in the WordPress...
WordPress Plugin Word Replacer Pro Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
Session Fixation
org.graylog2:graylog2-server is vulnerable to Session Fixation. The vulnerability is due to missing token checks when authentication is performed with an existing session id. Pre-existing session can be used to gain elevated access to an existing session, provided the attacker is able to inject a...
CVE-2023-6066
The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callback functions, which could allow attackers with subscriber+ privilege to create, delete or modify menus on the site...
Cross site request forgery (csrf)
The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version 4.5.1, a cross-site request forgery vulnerability in the query on XWiki tool allows executing arbitrary database queries on the database of the XWiki installation. Among other things, this allow...
CVE-2023-48293 XWiki Admin Tools Application CSRF with QueryOnXWiki allows arbitrary database queries
The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version 4.5.1, a cross-site request forgery vulnerability in the query on XWiki tool allows executing arbitrary database queries on the database of the XWiki installation. Among other things, this allow...
Yzmcms 跨站请求伪造漏洞
Yzmcms is an open source CMS Content Management System for Yzmcms individual developers. A security vulnerability exists in Yzmcms version 2.0. Attackers use the vulnerability to execute arbitrary code through the token checking function...
PT-2023-2250 · Envoy · Envoy
Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.26.0 Envoy versions prior to 1.25.3 Envoy versions prior to 1.24.4 Envoy versions prior to 1.23.6 Envoy versions prior to 1.22.9 Description: The issue is related to insufficient input validation when processing the...
WordPress plugin ContentStudio 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
All swapping functions lack checks for returned tokens
Lines of code Vulnerability details Impact Every function that stems from the GenericSwapFacet lacks checks to ensure that some tokens have been returned via the swaps. In LibSwap.sol in the swap function, the swap call is sent to the target DEX. A return of success is required, otherwise the...
PT-2022-13113 · Moodle +1 · Moodle +1
Name of the Vulnerable Software and Affected Versions: Moodle versions 3.11 to 3.11.4 Moodle versions 3.10 to 3.10.8 Moodle versions 3.9 to 3.9.11 Moodle versions earlier than 3.9 Description: A flaw was found in the "delete badge alignment" functionality, which did not include the necessary toke...
Joomla! 2.5.x < 3.9.19 Multiple Vulnerabilities
According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.19. It is, therefore, affected by multiple vulnerabilities : - Lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" module...
CVE-2020-13760
In Joomla! before 3.9.19, missing token checks in compostinstall lead to CSRF...
Cross site request forgery (csrf)
In Joomla! before 3.9.19, missing token checks in compostinstall lead to CSRF...
[20200605] - Core - CSRF in com_postinstall
Missing token checks in compostinstall cause CSRF vulnerabilities...
CVE-2020-10241
An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of comtemplates lead to CSRF...
CVE-2020-10241
An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of comtemplates lead to CSRF...
PT-2020-11997 · Open Source Matters · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.16 Description: An issue was discovered in the image actions of com templates, where missing token checks lead to CSRF. Recommendations: For versions prior to 3.9.16, update to version 3.9.16 or later to resolve...