4553 matches found
PT-2022-14898 · Unknown · Express-Xss-Sanitizer
Name of the Vulnerable Software and Affected Versions: express-xss-sanitizer versions prior to 1.1.3 Description: The issue allows attackers to bypass xss sanitization due to Prototype Pollution via the allowedTags attribute. This enables the attacker to exploit the vulnerability, potentially...
PT-2022-14007 · WordPress · Restricted Site Access
Name of the Vulnerable Software and Affected Versions: Restricted Site Access WordPress plugin versions prior to 7.3.2 Description: The issue allows bypassing IP-based limitations in certain situations due to the plugin prioritizing a visitor's IP from certain HTTP headers over PHP's REMOTE ADDR...
PT-2022-20598 · WordPress · Oauth Client Single Sign On
Name of the Vulnerable Software and Affected Versions: OAuth client Single Sign On WordPress plugin versions prior to 3.0.4 Description: The issue concerns a lack of authorization and CSRF protection when updating settings in the OAuth client Single Sign On WordPress plugin. This could allow...
PT-2022-16047 · WordPress · Post Smtp Mailer/Email Log
Name of the Vulnerable Software and Affected Versions: Post SMTP Mailer/Email Log WordPress plugin versions prior to 2.1.7 Description: The issue concerns a lack of proper authorization in some AJAX actions within the plugin, potentially allowing high-privilege users, such as administrators, to...
PT-2022-20434 · WordPress · Login Block Ips
Name of the Vulnerable Software and Affected Versions: Login Block IPs WordPress plugin versions 1.0.0 and earlier Description: The issue concerns a lack of CSRF check when updating settings in the Login Block IPs WordPress plugin. This could allow attackers to make a logged-in admin change...
PT-2022-24193 · WordPress · Read More By Adam
Name of the Vulnerable Software and Affected Versions: Read more By Adam plugin version 1.1.8 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Read more By Adam plugin at WordPress, allowing unauthorized actions to be performed on behalf of a user without their...
PT-2022-21433 · Rdiffweb · Rdiffweb
Name of the Vulnerable Software and Affected Versions: rdiffweb versions prior to 2.4.6 Description: The issue is related to Cross-Site Request Forgery CSRF in the repository settings. A malicious user can change the settings of a repository by sending a URL to the victim. Recommendations: For...
PT-2022-24497 · Apache +5 · Apache Xml Graphics Batik +5
Name of the Vulnerable Software and Affected Versions: Apache XML Graphics Batik version 1.14 Description: A Server-Side Request Forgery SSRF issue allows an attacker to fetch external resources. This can be exploited by an attacker to access resources that should not be accessible...
PT-2022-6741 · Nlnet +8 · Unbound +8
Name of the Vulnerable Software and Affected Versions: Unbound versions prior to 1.16.3 Description: The issue is related to a Non-Responsive Delegation Attack NRDelegation Attack that affects various DNS resolving software, including Unbound. This attack involves a malicious delegation with a...
PT-2022-21232 · Rdiffweb · Rdiffweb
Name of the Vulnerable Software and Affected Versions: rdiffweb versions prior to 2.4.6 Description: The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository ikus060/rdiffweb. This could potentially lead to disabling notifications in a user's profile. Recommendations: For...
PT-2022-24833 · Netlify · Netlify-Ipx
Name of the Vulnerable Software and Affected Versions: netlify-ipx versions prior to 1.2.3 Description: The issue allows an attacker to bypass the source image domain allowlist by sending specially crafted headers, causing the handler to load and return arbitrary images. Because the response is...
PT-2022-16361 · Keylime · Keylime
Name of the Vulnerable Software and Affected Versions: Keylime versions prior to 6.3.0 Description: The issue arises from the Revocation Notifier in Keylime using a fixed /tmp path for a UNIX domain socket. This can be exploited by unprivileged users to prohibit Keylime operations. Recommendation...
PT-2022-23345 · WordPress · Soflyy Import Any Xml/Csv File To Wordpress
Name of the Vulnerable Software and Affected Versions: Soflyy Import any XML or CSV File to WordPress plugin versions = 3.6.7 Description: The issue is related to an Authenticated Arbitrary Code Execution vulnerability. This allows for the execution of arbitrary code by an authenticated user...
PT-2022-21349 · Minarca · Minarca
Name of the Vulnerable Software and Affected Versions: minarca versions prior to 4.2.2 Description: The issue concerns a sensitive cookie in an HTTPS session that lacks the 'Secure' attribute. This problem is identified in the GitHub repository ikus060/minarca. Recommendations: For versions prior...
PT-2022-19284 · Octoprint · Octoprint
Name of the Vulnerable Software and Affected Versions: OctoPrint versions prior to 1.8.3 Description: The issue allows an attacker to authenticate using a victim's OctoPrint session cookie as long as the victim's account exists. This can be done if the attacker comes into possession of the cookie...
PT-2022-22627 · Testlink · Testlink
Name of the Vulnerable Software and Affected Versions: TestLink version 1.9.20 Description: A Cross-Site Request Forgery CSRF issue was found via the "/lib/plan/planView.php" API endpoint. Recommendations: For version 1.9.20, update to a newer version that contains a fix for this issue...
PT-2022-25359 · Z Blogphp · Z-Blogphp
Name of the Vulnerable Software and Affected Versions: Z-BlogPHP versions prior to 1.7.3 Description: A security issue was discovered that allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter, due to a Server-Side...
PT-2022-20187 · Tibco Software · Tibco Spotfire Analytics Platform For Aws Marketplace +1
Name of the Vulnerable Software and Affected Versions: TIBCO Spotfire Analytics Platform for AWS Marketplace version 12.0.0 TIBCO Spotfire Server version 12.0.0 Description: The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire...
PT-2022-19986 · Unknown · Yetiforcecrm
Name of the Vulnerable Software and Affected Versions: YetiForce CRM versions prior to 6.4.0 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the YetiForce CRM GitHub repository. The SlaPolicy module is vulnerable to cross-site scripting. Recommendations: For...
