WordPress Zephyr Project Manager Plugin <= 3.3.9 is vulnerable to Open Redirection

Software Zephyr Project Manager Type Plugin Vulnerable versions = 3.3.9 Fixed in 3.3.91 OWASP Top 10 A6: Security Misconfiguration Classification Open Redirection CVE CVE-2023-31237 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 0a67e197ec76 Credits Nguyen Xuan Chien...

Zephyr 安全漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by the Zephyr Project. A security vulnerability exists in SmartBear Zephyr Enterprise 7.15.0 and earlier versions, which stems from a contained arbitrary file read vulnerability. An attacker can exploit this vulnerability to rea...

zephyr 安全漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by the Zephyr Project. A security vulnerability exists in zephyr that stems from its failure to check if slot 0 is uploaded from the device to the host resulting in unencrypted firmware that can be easily retrieved when an...

Zephyr 安全漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by the Zephyr Project. A security vulnerability exists in zephyr that stems from a buffer overflow problem...

WordPress Zephyr Project Manager 3.2.42 SQL Injection

Exploit Title: Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLi Date: 14-08-2022 Exploit Author: Rizacan Tufan Blog Post: https://rizax.blog/blog/wordpress-plugin-zephyr-project-manager-multiple-sqli-authenticated Software Link: https://wordpress.org/plugins/zephyr-project-manager/...

Wordpress Zephyr Project Manager 3.2.42 Plugin - Multiple SQL injection Vulnerabilities

Exploit Title: Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLi Exploit Author: Rizacan Tufan Blog Post: https://rizax.blog/blog/wordpress-plugin-zephyr-project-manager-multiple-sqli-authenticated Software Link: https://wordpress.org/plugins/zephyr-project-manager/ Vendor Homepage:...

Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLi

Exploit Title: Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLi Date: 14-08-2022 Exploit Author: Rizacan Tufan Blog Post: https://rizax.blog/blog/wordpress-plugin-zephyr-project-manager-multiple-sqli-authenticated Software Link: https://wordpress.org/plugins/zephyr-project-manager/...

CVE-2022-2839

The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them t...

CVE-2022-2839

The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them t...

Cross site scripting

The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them t...

CVE-2022-2839 Zephyr Project Manager < 3.2.55 - Unauthorised AJAX Calls To Stored XSS

The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them t...

CVE-2022-2839

CVE-2022-2839 affects the Zephyr Project Manager WordPress plugin prior to 3.2.55. The vulnerability stems from missing authorization and CSRF protection on all AJAX actions, enabling unauthenticated calls. Additionally, lack of input sanitisation/escaping could allow Stored XSS against logged-in...

WordPress plugin Zephyr Project Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Zephyr Project Manager version 3.2.55 previously had a cross-site scripting vulnerability that...

PT-2022-18997 · Unknown · Zephyr Project Manager

Name of the Vulnerable Software and Affected Versions: Zephyr Project Manager versions prior to 3.2.55 Description: The issue concerns a lack of authorization and CSRF protection in all AJAX actions of the plugin, allowing unauthenticated users to call these actions directly or through CSRF...

Zephyr Cross-Site Scripting Vulnerability

Zephyr is Zephyr Project open source a scalable real-time operating system RTOS. A cross-site scripting vulnerability exists in Zephyr Project Manager versions prior to 3.2.5, which stems from a lack of effective filtering and escaping of user-supplied data in the onanimationstart parameter, and...

CVE-2022-3333

A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible ...

CVE-2022-3333

A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible ...

Cross site scripting

A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible ...

CVE-2022-3333 Zephyr Project Manager REST Call cross site scripting

A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible ...

CVE-2022-3333

CVE-2022-3333 affects Zephyr Project Manager up to 3.2.4. The issue resides in the REST Call Handler’s file /v1/tasks/create/, where manipulation of the onanimationstart argument enables cross-site scripting. The vulnerability can be triggered remotely, implying network-accessible exploitation. A...