CVE-2021-4452

The Google Language Translator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions up to, and including, 6.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary we...

SAP NetWeaver AS ABAP Multiple Vulnerabilities (3488039)

Multiple vulnerabilities may be present in SAP NetWeaver Application Server ABAP, including the following: - The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be utilized to identify usernames and access informati...

U.S. Dept Of Defense: Improper Authentication Allows Making Appeals as Other Users

The vulnerability allowed unauthenticated users to submit appeals by manipulating HTTP responses. This undermined the security and integrity of the application, as users could perform actions reserved for logged-in users...

CVE-2024-2233

The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. These include declining and accepting group invitations or leaving a group...

Comtrend router WLD71-T1 cross-site request forgery vulnerability

Comtrend router WLD71-T1 is a router from China Comtrend Telecom Comtrend. A cross-site request forgery vulnerability exists in Comtrend router WLD71-T1 version v2.0.201820, which stems from vulnerability to a cross-site request forgery attack that allows an attacker to force an end user to perfo...

PT-2024-4808 · Ibm · Ibm Security Guardium

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium version 12.0 Description: The issue is related to an uncontrolled consumption of resources, which could allow a privileged user to perform unauthorized actions, potentially leading to a denial of service. This could put...

PT-2024-25680 · WordPress · Wp Prayer

Name of the Vulnerable Software and Affected Versions: WP Prayer WordPress plugin versions 2.0.9 and earlier Description: The issue concerns the lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unintended actions through CSRF attacks...

Convert Post Types <= 1.4 - Reflected Cross-Site Scripting

Description The Convert Post Types plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

BIT-MEDIAWIKI-2020-27621

The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for various actions, it would report the IP address of an internal Wikimedia Foundation server by omitting X-Forwarded-For data. This resulted in an...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates from a user triggering a divide-by-zero error...

CVE-2023-6671

A vulnerability has been discovered on OJS, that consists in a CSRF Cross-Site Request Forgery attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated...

XWiki Platform Cross-Site Scripting Vulnerability

XWiki Platform is a suite of Wiki platforms from the XWiki Foundation in France for creating collaborative web applications. A cross-site scripting vulnerability exists in XWiki Platform. An attacker could use this vulnerability to trick a user into visiting a link with specially crafted paramete...

CVE-2023-4307 Lock User Account <= 1.0.3 - Arbitrary Account Lock/Unlock via CSRF

The Lock User Account WordPress plugin through 1.0.3 does not have CSRF check when bulk locking and unlocking accounts, which could allow attackers to make logged in admins lock and unlock arbitrary users via a CSRF attack...

Privilege Escalation

github.com/kubeoperator/kubepi is vulnerable toPrivilege Escalation . The vulnerability exists due to improper permission restrictions when creating or updating users which allows an attacker to perform authorized actions on users such as changing roles...

CVE-2023-32693 Decidim Cross-site Scripting vulnerability in the external link redirections

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The external link feature is susceptible to cross-site scripting. This allows a remote attacker to execute JavaScript code in...

Multiple Plugins from Addify - Multiple CSRF

The plugins have flawed CSRF checks in various places, which could allow attackers to make logged in users perform unwanted actions PoC addify-order-approval-woocommerce - To make a logged in admin approve the order with ID 103...

ROS-2-1791

2.1791 Mozilla Firefox browser vulnerability CVE-2021-29970, CVE-2021-29976 1. Vulnerability description: CVE-2021-29970 A vulnerability in the Mozilla Firefox browser, is related to a release error in accessibility functions when processing HTML content. Exploitation of the vulnerability could...

CVE-2023-36662

The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24...

CVE-2023-36662

The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24...

CVE-2023-36662

The CVE-2023-36662 entry concerns the TechTime User Management components for Atlassian products, which allow stored XSS on the Bulk User Actions page. Affected are: Jira User Management 2.0.0–2.17.1; Confluence User Management 2.0.0–2.15.24; Bitbucket User Management 2.2.2–2.15.24. Root cause: s...