CVE-2023-1807

The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.3. This is due to missing or incorrect nonce validation on the togglewidget function. This makes it possible for unauthenticated attackers t...

WordPress Plugin Gravity Forms DPS PxPay 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2023-23641

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WPmanage Uji Popup plugin = 1.4.3 versions...

PT-2023-19099 · WordPress · Wpmanage Uji Popup

Name of the Vulnerable Software and Affected Versions: WPmanage Uji Popup plugin versions 1.4.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or those with higher authentication levels. There i...

WordPress plugin Uji Popup 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress Uji Popup Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Uji Popup Type Plugin Vulnerable versions = 1.4.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23641 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 59d88f6966b4 Credits István Márton Required privileg...

alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting

alextselegidis/easyappointments is vulnerable to stored cross-site scripting in versions 1.4.3 and prior. A patch is available at commit bddc5cbeb7ff237a72943b304dcb01c653781767 and anticipated to be part of version 1.5.0...

GHSA-J6QQ-9939-9JV8 alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting

alextselegidis/easyappointments is vulnerable to stored cross-site scripting in versions 1.4.3 and prior. A patch is available at commit bddc5cbeb7ff237a72943b304dcb01c653781767 and anticipated to be part of version 1.5.0...

PolyMC Launcher 路径遍历漏洞

PolyMC is a custom launcher for Minecraft that makes it easy to manage multiple installations of Minecraft simultaneously. A security vulnerability exists in PolyMC Launcher 1.4.3 and earlier versions, which stems from a directory traversal vulnerability that can be exploited by an attacker to...

go-fastdfs 代码问题漏洞

go-fastdfs is a simple distributed file system private cloud storage, with no center, high performance, high reliability, maintenance-free and other advantages, support for intermittent uploads, chunked uploads, small file merging, auto-synchronization, auto-repair. sjqzhang go-fastdfs version...

Multiple XSS in Create/Update Funtion Version 1.4.3 and 1.5.0-dev.2

Description Stored XSS on create/update service, categories, settings. I was test on 1.4.3 demo site and 1.5.0-dev2 Proof of Concept Install\ I install from develope branch. When finish install footer display version v1.5.0-dev.2\ The time I run and commit below on image is the latest\ \ webUI\ ...

PT-2023-20953 · Unknown · Opengoofy Hippo4J

Name of the Vulnerable Software and Affected Versions: OpenGoofy Hippo4j version 1.4.3 Description: The issue allows an attacker to obtain sensitive information via the ConfigVerifyController function of the Tenant Management module. Recommendations: For OpenGoofy Hippo4j version 1.4.3, consider...

OpenGoofy Hippo4j 安全漏洞

OpenGoofy Hippo4j is a powerful dynamic thread pooling framework from OpenGoof that comes with monitoring and alerting features. A security vulnerability exists in OpenGoofy Hippo4j v.1.4.3, which stems from an insecure privilege setting. An attacker can exploit the vulnerability to obtain...

PT-2023-20951 · Unknown · Opengoofy Hippo4J

Name of the Vulnerable Software and Affected Versions: OpenGoofy Hippo4j version 1.4.3 Description: An issue in OpenGoofy Hippo4j allows attackers to escalate privileges via the ThreadPoolController of the tenant Management module. Recommendations: For OpenGoofy Hippo4j version 1.4.3, consider...

OpenGoofy Hippo4j 安全漏洞

OpenGoofy Hippo4j is a powerful dynamic thread pooling framework from OpenGoof with monitoring and alerting features. A security vulnerability exists in OpenGoofy Hippo4j v.1.4.3, which can be exploited by an attacker to elevate privileges via the ThreadPoolController in the tenant management...

OpenGoofy Hippo4j 安全漏洞

OpenGoofy Hippo4j is a powerful dynamic thread pooling framework from OpenGoof that comes with monitoring and alerting features. A security vulnerability exists in OpenGoofy Hippo4j version v.1.4.3, which stems from an insecure privilege vulnerability that can be exploited by an attacker to eleva...

PT-2023-20952 · Unknown · Opengoofy Hippo4J

Name of the Vulnerable Software and Affected Versions: OpenGoofy Hippo4j version 1.4.3 Description: The issue allows an attacker to escalate privileges via the AddUser method of the UserController function in the Tenant Management module. This is due to an Insecure Permissions vulnerability...

SUSE CVE-2010-0991

Multiple heap-based buffer overflows in imlib2 1.4.3 allow context-dependent attackers to execute arbitrary code via a crafted 1 ARGB, 2 XPM, or 3 BMP file, related to the IMAGEDIMENSIONSOK macro in lib/image.h...

SUSE CVE-2022-32209

Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3 ImpactA possible XS...

CVE-2023-0379 Spotlight Social Feeds < 1.4.3 - Contributor+ Stored XSS

The Spotlight Social Feeds WordPress plugin before 1.4.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...