CSV Injection while export users

1 admin add a user, or a user signup. 2 the user logins and edit himeself 3 the user change his realname as "=1+cmd|'/C calc'!A0" 4 admin go to export the users as a csv file 5 admin open the csv and we can see that the calculator is opened. see https://owasp.org/www-community/attacks/CSVInjectio...

CVE-2023-35938 User access not updated with privilege change in Tuleap

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. When switching from a project visibility that allows restricted users to Private without restricted, restricted users that are project administrators keep this access right. Restricted users tha...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS when rendering pages in pages/actionscomponent.html.erb. A user can embed scripts in a page title via the pageencontentattributes0title parameter. PoC '" Details Cross-site scripting or XSS is a code vulnerabili...

Schneider Electric Modicon Cross-Site Request Forgery (CVE-2020-7534)

A CWE-352: Cross-Site Request Forgery CSRF vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on the web server during the time the user is logged in. Affected Products: Modicon M340 CPUs: BMXP34 All Versions, Modicon Quantum CPUs with...

CVE-2023-20136

A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid user credentials. This vulnerability is due to improper...

Incorrect Authorization

gitlab is vulnerable to Incorrect Authorization. The vulnerability allows unauthorised users to steal runner registration tokens using the quick actions command...

CVE-2023-26273

IBM QRadar SIEM 7.5.0 could allow an authenticated user to perform unauthorized actions due to hazardous input validation. IBM X-Force ID: 248134...

CVE-2023-26273

IBM QRadar SIEM 7.5.0 could allow an authenticated user to perform unauthorized actions due to hazardous input validation. IBM X-Force ID: 248134...

Input validation

IBM QRadar SIEM 7.5.0 could allow an authenticated user to perform unauthorized actions due to hazardous input validation. IBM X-Force ID: 248134...

CVE-2023-26273

CVE-2023-26273 affects IBM QRadar SIEM 7.5.0 with vulnerable input validation that could let an authenticated user perform unauthorized actions. The core issue is hazardous input validation; CVSS base score is 4.3 (MEDIUM) with Network attack vector, low attack complexity, and privileges required...

CVE-2023-2628

The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks either flawed or missing completely in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary...

CVE-2023-2628

The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks either flawed or missing completely in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary...

Cross site request forgery (csrf)

The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings...

Cross site request forgery (csrf)

The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks either flawed or missing completely in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary...

Cross-Site Request Forgery (CSRF)

Jenkins Digital.ai App Management Publisher Plugin is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists because some HTTP endpoints do not require authentication, which allows an attacker to perform unauthorized actions...

PT-2023-20582 · WordPress · Kivicare

Name of the Vulnerable Software and Affected Versions: KiviCare WordPress plugin versions prior to 3.2.1 Description: The issue concerns the lack of CSRF checks in various AJAX actions, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks. This includes...

PT-2023-5201 · Ibm · Ibm Qradar Siem

Name of the Vulnerable Software and Affected Versions: IBM QRadar SIEM version 7.5.0 Description: The issue exists due to insufficient input validation, allowing a remote attacker to perform administrative actions. An authenticated user may be able to perform unauthorized actions. Recommendations...

CVE-2023-36662

The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24...

CVE-2023-36662

The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24...

CVE-2023-36662

The CVE-2023-36662 entry concerns the TechTime User Management components for Atlassian products, which allow stored XSS on the Bulk User Actions page. Affected are: Jira User Management 2.0.0–2.17.1; Confluence User Management 2.0.0–2.15.24; Bitbucket User Management 2.2.2–2.15.24. Root cause: s...