CVE-2024-6506

CVE-2024-6506 affects MRW plugin version 5.4.3, specifically the mrw_log functionality. The exposed data includes other customers’ order information and sensitive fields such as names and phone numbers, with an ability to create or overwrite shipping labels. The CVSSv3.1 base score is 8.2 (HIGH) ...

EulerOS Virtualization 2.11.1 : lua (EulerOS-SA-2023-2732)

According to the versions of the lua package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. CVE-2021-45985 Note that Tenab...

PT-2023-22069 · WordPress · Relywp Coupon Affiliates – Woocommerce Affiliate Plugin

Name of the Vulnerable Software and Affected Versions: RelyWP Coupon Affiliates – WooCommerce Affiliate Plugin versions = 5.4.3 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website...

WordPress Coupon Affiliates Plugin <= 5.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Coupon Affiliates Type Plugin Vulnerable versions = 5.4.3 Fixed in 5.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28992 Patch priority Medium CVSS severity Medium 7.1 Developer RelyWP PSID 3cc060340a7c Credits thiennv Required privile...

WordPress plugin Jetpack CRM 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

CVE-2022-33099 affecting package lua for versions less than 5.4.3-4

CVE-2022-33099 affecting package lua for versions less than 5.4.3-4. A patched version of the package is available...

GHSA-42GV-77F4-R3J9 Shopware SQL Injection

Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404...

CVE-2021-43519 affecting package lua for versions less than 5.4.3-1

CVE-2021-43519 affecting package lua for versions less than 5.4.3-1. A patched version of the package is available...

Symfony 5.3.14, 5.4.3, 6.0.3 CSRF Vulnerability (GHSA-vvmr-8829-6whx)

Symfony is prone to a missing cross-site request forgery CSRF token vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

CVE-2018-20713

Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404...

CVE-2018-15493

vBulletin 5.4.3 has an Open Redirect...

Elastic Kibana X-Pack 'CVE-2017-8443' Information Disclosure Vulnerability - Linux

Elastic Kibana with X-Pack is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fortinet FortiManager Open Redirect Vulnerability (FG-IR-17-014)

Fortinet FortiManager is prone to an open redirect vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Design/Logic Flaw

In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be...

Debian Security Advisory DSA 2465-1 (php5)

The remote host is missing an update to php5 announced via advisory DSA 2465-1. OpenVAS Vulnerability Test $Id: deb24651.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2465-1 php5 Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

PHP version 5.4.3 code execution exploit for Win32

No description provided by source. // Exploit Title: PHP 5.4 5.4.3 Code Execution 0day Win32 // Exploit author: 0in Maksymilian Motyl // Email: 0indotemailatgmail.com // Bug with Variant type parsing originally discovered by Condis // Tested on Windows XP SP3 fully patched Polish...

PHP CGI Query String Parameters Command Execution

Added: 05/15/2012 CVE: CVE-2012-1823 BID: 53388 OSVDB: 81633 Background PHP is a widely used general-purpose scripting language that is especially suited for Web development. Problem When configured as a CGI script aka php-cgi, PHP does not properly handle query string parameters which are passed...