CVE-2024-3672

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'all-items' shortcode in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping on user supplied attributes such as 'classes'. This makes it...

CVE-2024-32138

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KaizenCoders Short URL allows Reflected XSS.This issue affects Short URL: from n/a through 1.6.8...

ThreeTen backport project 安全漏洞

ThreeTen backport project is a simple backport for ThreeTen open source. A security vulnerability exists in ThreeTen backport project version v1.6.8, which stems from a null pointer exception contained in the component org. Threeten.bp.format.DateTimeFormatter parseCharSequence, ParsePosition...

PT-2024-19660

Name of the Vulnerable Software and Affected Versions ThreeTen Backport version 1.6.8 Description A NullPointerException was discovered in the component org.threeten.bp.LocalDate::compareToChronoLocalDate. However, the existence of this issue is disputed by multiple third parties due to potential...

CVE-2023-45771

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Contact Form With Captcha allows Reflected XSS.This issue affects Contact Form With Captcha: from n/a through 1.6.8...

PT-2024-13286

Name of the Vulnerable Software and Affected Versions Contact Form With Captcha versions 1.6.8 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means an attacker can inject...

GHSA-VF5M-XRHM-V999 Nautobot missing object-level permissions enforcement when running Job Buttons

Impact When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have permission to run Jobs in general?. Object-level permissions i.e., does the user have permission to run this specific Job? are not enforced by the URL/view used ...

tribe29 Checkmk Security Vulnerabilities

tribe29 Checkmk is an application from the German company tribe29. It provides a comprehensive solution for monitoring applications, servers and networks. A security vulnerability exists in the tribe29 Checkmk Appliance versions prior to 1.6.8. An attacker exploited the vulnerability to retrieve...

libX11 security update

1.6.8-6 - CVE fix for: CVE-2023-3138 Resolve: rhbz2213762...

PT-2023-21129 · Unknown · Gl Spice New Adman Plugin

Name of the Vulnerable Software and Affected Versions: gl SPICE New Adman plugin versions = 1.6.8 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

CVE-2023-22094

Vulnerability in the MySQL Installer product of Oracle MySQL component: Installer: General. Supported versions that are affected are Prior to 1.6.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Installer executes to compromise MySQL...

WordPress plugin Short URL cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

SVG Loader Cross-Site Scripting Vulnerability

SVG Loader is a simple JS library that uses XHR to fetch SVG and injects SVG code into the location of the tag. A cross-site scripting vulnerability exists in SVG Loader version 1.6.8 and prior versions, which stems from insufficient input cleanup logic and can be easily bypassed...

PT-2023-24346 · Masteriyo · The Lms By Masteriyo

Name of the Vulnerable Software and Affected Versions: The LMS by Masteriyo WordPress plugin versions prior to 1.6.8 Description: The issue concerns improper authorization in some of the plugin's REST API endpoints. This allows any students to retrieve email addresses of other students, effective...

CVE-2023-27439

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in glSPICE New Adman plugin = 1.6.8 versions...

PT-2023-21127 · Unknown · Gl Spice New Adman Plugin

Name of the Vulnerable Software and Affected Versions: gl SPICE New Adman plugin versions 1.6.8 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For gl SPICE New Adman plugin...

WordPress New Adman Plugin <= 1.6.8 is vulnerable to Cross Site Scripting (XSS)

Software New Adman Type Plugin Vulnerable versions = 1.6.8 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-27439 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b28d3bea3ea7 Credits Rio Darmawan Required privilege...

AgileConfig 信任管理问题漏洞

AgileConfig is a lightweight configuration center for .NET Core-based development in the China .NET Core Community community. A trust management issue vulnerability exists in AgileConfig version 1.6.8, which stems from a hard-coded JWT Secret in the server that allows remote attackers to gain...

Mageia: Security Advisory (MGASA-2014-0350)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-42363

The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the searchorder parameter found in the /views/form.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.6.8...