Cross site scripting

Certain dashboard widgets on Trend Micro Apex Central on-premise are vulnerable to cross-site scripting XSS attacks that may allow an attacker to achieve remote code execution on affected servers. Please note this vulnerability is similar, but not identical to CVE-2023-52327...

Cross site scripting

Certain dashboard widgets on Trend Micro Apex Central on-premise are vulnerable to cross-site scripting XSS attacks that may allow an attacker to achieve remote code execution on affected servers. Please note this vulnerability is similar, but not identical to CVE-2023-52329...

CVE-2023-52329

Certain dashboard widgets on Trend Micro Apex Central on-premise are vulnerable to cross-site scripting XSS attacks that may allow an attacker to achieve remote code execution on affected servers. Please note this vulnerability is similar, but not identical to CVE-2023-52326...

CVE-2023-52329

Certain dashboard widgets on Trend Micro Apex Central on-premise are vulnerable to cross-site scripting XSS attacks that may allow an attacker to achieve remote code execution on affected servers. Please note this vulnerability is similar, but not identical to CVE-2023-52326...

CVE-2023-52326

Certain dashboard widgets on Trend Micro Apex Central on-premise are vulnerable to cross-site scripting XSS attacks that may allow an attacker to achieve remote code execution on affected servers. Please note this vulnerability is similar, but not identical to CVE-2023-52327...

Trend Micro Apex Central Security Vulnerability

Trend Micro Apex Central is a web-based console from Trend Micro. A security vulnerability exists in Trend Micro Apex Central that stems from a cross-site scripting XSS vulnerability in certain dashboard widgets. An attacker could exploit the vulnerability to execute remote code on an affected...

WordPress Cryptocurrency Widgets – Price Ticker & Coins List Plugin <= 2.0 is vulnerable to SQL Injection

Software Cryptocurrency Widgets – Price Ticker & Coins List Type Plugin Vulnerable versions = 2.0 Fixed in 2.6.6 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-0709 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID eb9b26b5950f Credits vollkorntomate...

Cryptocurrency Widgets – Price Ticker & Coins List 2.0 - 2.6.5 - Unauthenticated SQL Injection

Description The Cryptocurrency Widgets – Price Ticker & Coins List plugin for WordPress is vulnerable to SQL Injection via the 'coinslist' parameter in versions 2.0 to 2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

WordPress Custom Dashboard Widgets Plugin <= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Dashboard Widgets Type Plugin Vulnerable versions = 1.3.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-22290 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 9f6ec6ec2096 Credits Dimas Maulan...

PT-2024-14525 · Trend Micro · Trend Micro Apex Central

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central on-premise affected versions not specified Description: The issue concerns certain dashboard widgets in Trend Micro Apex Central that are susceptible to cross-site scripting XSS attacks. These attacks may potentially...

CVE-2023-52225

Deserialization of Untrusted Data vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1...

CVE-2023-52225

Deserialization of Untrusted Data vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1...

Deserialization of untrusted data

Deserialization of Untrusted Data vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1...

CVE-2023-52225

CVE-2023-52225 describes a deserialization of untrusted data vulnerability in the WordPress plugin Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics . Affected versions are listed as up to version 3.1 (n/a to 3.1); the root cause is improper deserialization of untrusted input...

PT-2024-14489 · Unknown · Tagbox – Ugc Galleries

Name of the Vulnerable Software and Affected Versions: Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics versions n/a through 3.1 Description: The issue is related to Deserialization of Untrusted Data, which affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews &...

CVE-2023-52136

Cross-Site Request Forgery CSRF vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2...

WordPress SiteOrigin Widgets Bundle Plugin < 1.51.0 LFI Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:siteorigin:siteoriginwidgetsbundle"; if description...

CVE-2023-6295

The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites...

Design/Logic Flaw

The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites...

CVE-2023-6295 so-widgets-bundle < 1.51.0 - Admin+ Local File Inclusion

The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites...