PT-2023-15138 · Unknown · Action Launcher

Name of the Vulnerable Software and Affected Versions: Action Launcher version 50.5 Description: An issue was found that allows an attacker to escalate privilege via modification of the intent string to the update function. Recommendations: For Action Launcher version 50.5, consider restricting...

CVE-2022-47028

An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary data injection to function insert...

CVE-2022-47028

CVE-2022-47028 affects Action Launcher for Android (v50.5). The issue allows an attacker to cause a denial of service via arbitrary data injection in the insert function. Impact: availability disruption as described across multiple sources. A temporary workaround noted for Action Launcher for And...

CVE-2022-47029

CVE-2022-47029 affects Action Launcher v50.5. The issue enables privilege escalation by altering the intent string to invoke the internal update function. Documented impact is high (confidentiality, integrity, and availability), with a local attack vector and no privileges required, but user inte...

CVE-2022-47029

An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent string to function update...

PT-2023-17354 · WordPress · Wp Fastest Cache

Name of the Vulnerable Software and Affected Versions: WP Fastest Cache versions prior to 1.1.5 Description: The issue is related to the lack of a CSRF check in an AJAX action and insufficient validation of user input before using it in the wp remote get function, leading to a Blind SSRF issue...

CVE-2022-47029

An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent string to function update...

WordPress Floating Action Button Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Floating Action Button Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A2: Broken Authentication Classification Cross Site Request Forgery CSRF CVE CVE-2023-31088 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID cfe34c0e96d6 Credits Yuki Haruma...

CVE-2022-47028

An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary data injection to function insert...

Action Launcher 安全漏洞

Action Launcher is a powerful launcher from Action Launcher, Inc. A security vulnerability exists in Action Launcher version v50.5, which stems from a vulnerability that allows an attacker to elevate privileges by modifying the modification string...

CVE-2022-41766

An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. Upon an action=rollback operation, the alreadyrolled message can leak a user name when the user has been revision deleted/suppressed...

CVE-2022-41766

MediaWiki contains a vulnerability (CVE-2022-41766) where, during action=rollback, the alreadyrolled message can leak the username of users who have been revision deleted or suppressed. Affected versions are: before 1.35.8; 1.36.x; and 1.37.x before 1.37.5; and 1.38.x before 1.38.3. Remediation p...

Markdown injection into github comment

Description Users can donate for builds by tipping [email protected]. There's a github action that will thank the user in a comment. The name is not sanitized and by using one such as the following, attackers can inject their own markdown into the comment. foo The "" breaks out of the context,...

PT-2023-3686 · Zyxel · Zyxel Usg Flex Series +6

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2 Zyxel USG FLEX series firmware versions 5.00 through 5.36 Patch 2 Zyxel USG FLEX 50W series firmware versions 5.00 through 5.36 Patch 2 Zyxel USG20W-VPN series firmware versions 5.0...

Indiana, Iowa, and Tennessee Pass Comprehensive Privacy Laws

Its been a big month for US data privacy. Indiana, Iowa, and Tennessee all passed state privacy laws, bringing the total number of states with a privacy law up to eight. No private right of action in any of those, which means its up to the states to enforce the laws...

Conditional Menus < 1.2.1 - Reflected XSS

The plugin does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open a page with the HTML code below '...

WIP Custom Login < 1.3.0 - Cross-Site Request Forgery (CSRF)

The plugin does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in user to submit a crafted request...

SUSE CVE-2023-1668

A flaw was found in openvswitch OVS. When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results for both kernel and userspace datapath in installing a datapath flow matching all IP protocols nwproto is wildcarded...

CVE-2023-2528

The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.24. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthenticated attackers to execute AJAX actions vi...

Cross site request forgery (csrf)

The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.24. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthenticated attackers to execute AJAX actions vi...