13575 matches found
Estatik Real Estate Plugin < 4.1.1 - Reflected XSS
Description The plugin does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open one of the URLs below some...
PT-2023-31834 · Unknown +1 · Symbolicator +1
Name of the Vulnerable Software and Affected Versions: Symbolicator versions 0.3.3 through 21.12.1 Description: The issue allows an attacker to make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could...
Spoofing
ONTAP Mediator versions prior to 1.7 are susceptible to a vulnerability that can allow an unauthenticated attacker to enumerate URLs via REST API...
CVE-2023-49176
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodeRevolution WP Pocket URLs allows Reflected XSS.This issue affects WP Pocket URLs: from n/a through 1.0.2...
CVE-2023-49176
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodeRevolution WP Pocket URLs allows Reflected XSS.This issue affects WP Pocket URLs: from n/a through 1.0.2...
Cross site scripting
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodeRevolution WP Pocket URLs allows Reflected XSS.This issue affects WP Pocket URLs: from n/a through 1.0.2...
CVE-2023-49176 WordPress WP Pocket URLs Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodeRevolution WP Pocket URLs allows Reflected XSS.This issue affects WP Pocket URLs: from n/a through 1.0.2...
CVE-2023-49176
CVE-2023-49176: WordPress WP Pocket URLs plugin <= 1.0.2 is vulnerable to Reflected XSS due to improper input neutralization during web page generation. Public details indicate unauthenticated exploitation via crafted inputs in URLs could lead to script execution in victims’ browsers. A fix wa...
WordPress Plugin WP Pocket URLs Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...
PT-2023-31094 · Coderevolution · Coderevolution Wp Pocket Urls
Name of the Vulnerable Software and Affected Versions: CodeRevolution WP Pocket URLs versions 1.0.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...
Apache Shiro 输入验证错误漏洞
Apache Shiro is the United States Apache Apache Foundation set of Java security framework for performing authentication, authorization, encryption and session management . Apache Shiro suffers from an open redirect vulnerability that can be exploited by a remote attacker to submit a special uri...
Exploit for Improper Access Control in Joomla Joomla\!
CVE-2023-23752 CVE-2023-23752 Joomla Unauthenticated Informati...
CVE-2023-6542
Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep links without any validation directly from the host application. On successful attack, an attacker could navigate to arbitrary URL...
CVE-2023-6542 Improper Export of Android Application Components in SAP EMARSYS SDK ANDROID
Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep links without any validation directly from the host application. On successful attack, an attacker could navigate to arbitrary URL...
SSRF & Credentials Leak
Summary nuxt-api-party allows developers to proxy requests to an API without exposing credentials to the client. A previous vulnerability allowed an attacker to change the baseURL of the request, potentially leading to credentials being leaked or SSRF. This vulnerability is similar, and was cause...
GHSA-3WFP-253J-5JXV SSRF & Credentials Leak
Summary nuxt-api-party allows developers to proxy requests to an API without exposing credentials to the client. A previous vulnerability allowed an attacker to change the baseURL of the request, potentially leading to credentials being leaked or SSRF. This vulnerability is similar, and was cause...
Nautobot Security Vulnerability
Nautobot is a web automation platform by the individual developers of Nautobot. A security vulnerability exists in Nautobot versions 1.1.0 through 1.6.7, prior to 2.0.6, which stems from the fact that in the default configuration used by Nautobot, URLs are accessible by default without any user...
DoFollow Case by Case < 3.5.0 - Email&URLs Adding to Allowlist via CSRF
Description The plugin does not have CSRF checks in its getEmail and getUrl functions, which could allow attackers to make logged in admins add email and URLs to the allow list via CSRF attacks...
nuxt-api-party Code Issue Vulnerability
nuxt-api-party is an open source module by Johann Schopplich, an individual developer, for proxying API requests. A code issue vulnerability exists in nuxt-api-party version 0.21.3, which stems from lax URL detection, where absolute URLs with leading spaces can bypass this regular expression,...
GHSA-J4G3-3Q8X-JXQP dbt-core's secret env vars written to package-lock.json in plaintext
Impact When used to pull source code from a private repository using a Personal Access Token PAT, some versions of dbt-core write a URL with the PAT in plaintext to the package-lock.yml file. Patches The bug has been fixed in dbt-core v1.7.3. Mitigations Remove any git URLs with plaintext secrets...