Cross site scripting

PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the ValidateCore::isCleanHTML method of Prestashop misses hijackable events which can lead to cross-site scripting XSS injection, allowed by the presence of pre-setup @keyframes methods. This XSS, which...

Spoofing

PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 contain a patch for this issue. There are ...

CVE-2023-30839

PrestaShop vulnerability CVE-2023-30839 affects versions older than 8.0.4 and 1.7.8.9, with a SQL filtering flaw that lets a back‑office (BO) user write, update, and delete data despite limited rights. The issue is mitigated by patches in 8.0.4 and 1.7.8.9; no public workarounds are documented in...

CVE-2023-30838

PrestaShop suffers a XSS vulnerability (CVE-2023-30838) where ValidateCore::isCleanHTML() misses hijackable events, allowing attribute hijacking via pre-setup @keyframes. Affected versions are prior to 8.0.4 and 1.7.8.9. The issue can be triggered without user interaction, potentially impacting a...

CVE-2023-30838 PrestaShop vulnerable to possible XSS injection through Validate::isCleanHTML method

PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the ValidateCore::isCleanHTML method of Prestashop misses hijackable events which can lead to cross-site scripting XSS injection, allowed by the presence of pre-setup @keyframes methods. This XSS, which...

CVE-2023-30545

The CVE-2023-30545 vulnerability affects PrestaShop prior to versions 8.0.4 and 1.7.8.9. A user with access to the SQL Manager (Advanced Options → Database) can read arbitrary files on the operating system by using the SQL function LOAD_FILE in a SELECT request, exposing confidential information....

Tiempo.com <= 0.1.2 - Shortcode Deletion via CSRF

The plugin does not have CSRF check when deleting its shortcode, which could allow attackers to make logged in admins delete arbitrary shortcode via a CSRF attack Make a logged in admin open the URL below, this will make them delete the shortcode with ID 1...

The vulnerability of the network access control tool Fortinet FortiNAC arises from the lack of measures taken to protect the website structure. This allows attackers to carry out XSS attacks.

The vulnerability of the Fortinet FortiNAC network access control device exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using specially crafted HTTP requests...

WordPress Modula Image Gallery Plugin < 2.6.91 Broken Access Control Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2023-22683 · Unknown · Pear Admin Boot

Name of the Vulnerable Software and Affected Versions: Pear-Admin-Boot versions up to 2.0.2 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title of a private message. This enables attackers to...

CVE-2023-22581

White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application the default installation makes the webserver run as the root user...

CVE-2023-22581

White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application the default installation makes the webserver run as the root user...

Design/Logic Flaw

White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application the default installation makes the webserver run as the root user...

CVE-2023-22581 White Rabbit Switch - Unauthenticated remote code execution

White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application the default installation makes the webserver run as the root user...

Fedora 36 : mod_security (2023-8aa264d5c5)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-8aa264d5c5 advisory. - new version 2.9.7 - switch to PCRE2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora 37 : mod_security (2023-09f0496e60)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-09f0496e60 advisory. - new version 2.9.7 - switch to PCRE2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora 38 : mod_security (2023-bc61f7a145)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-bc61f7a145 advisory. - new version 2.9.7 - switch to PCRE2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

White Rabbit Switch 安全漏洞

The White Rabbit Switch WRS is an open hardware design from the OPEN HARDWARE organization. A security vulnerability exists in White Rabbit Switch. An attacker could exploit the vulnerability to execute system commands in the context of a web application...

SMTP server credentials are returned

Description The vulnerability discovered in the Calibre-Web application is a security flaw in the management of email configurations that allows the SMTP server credentials to be viewed by an account with editing permission. This could allow a malicious user with access to the administrative...

[SECURITY] Fedora 36 Update: mod_security-2.9.7-1.fc36

ModSecurity is an open source intrusion detection and prevention engine for web applications. It operates embedded into the web server, acting as a powerful umbrella - shielding web applications from attacks...