14320 matches found
CVE-2023-0293
The CVE-2023-0293 entry concerns the WordPress plugin Mediamatic – Media Library Folders . A missing capability check on the plugin’s AJAX actions in versions up to and including 2.8.1 enables an attacker authenticated as a subscriber or higher to bypass authorization and alter image categories u...
carolinacommunityactions.org Cross Site Scripting vulnerability OBB-3147862
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2023-16148 · WordPress · Mediamatic – Media Library Folders
Name of the Vulnerable Software and Affected Versions: Mediamatic – Media Library Folders plugin for WordPress versions up to, and including, 2.8.1 Description: The issue is related to a missing capability check on AJAX actions, allowing authenticated attackers with subscriber-level permissions a...
CVE-2022-46368
Rumpus - FTP server version 9.0.7.1 Cross-site request forgery CSRF – vulnerability may allow unauthorized action on behalf of authenticated users...
PT-2023-14917 · Rumpus · Rumpus
Name of the Vulnerable Software and Affected Versions: Rumpus - FTP server version 9.0.7.1 Description: The issue is related to cross-site request forgery CSRF, which may allow unauthorized actions to be taken on behalf of authenticated users. Recommendations: For Rumpus - FTP server version...
Malicious code in github-actions-slack (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0838fb57bbc4692fe40f976eb83599cc51f263c1c3a3eb1b231cbb7939a34a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-474 Malicious code in github-actions-slack (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0838fb57bbc4692fe40f976eb83599cc51f263c1c3a3eb1b231cbb7939a34a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
SAP NetWeaver AS 访问控制错误漏洞
SAP NetWeaver AS is a SAP network application server from SAP. It not only provides network services, but also the basic platform for SAP software. An Access Control Error vulnerability exists in the Java-based SAP NetWeaver AS version 7.50, which stems from improper access control, and can be...
PT-2023-1086 · Microsoft · Sharepoint Server +1
Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: The issue is related to insufficient input validation in Microsoft SharePoint Server, which can be exploited by a remote attacker to execute arbitrary code and impact th...
PT-2023-1074 · Microsoft · Office
Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Description: The issue is related to insufficient input validation in Microsoft Office packages, which can be exploited to execute arbitrary code. This can allow an attacker to perform...
CVE-2022-4426
The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack...
CVE-2022-3343 WPQA < 5.9.3 - Missing validation lead to functionality abuse
The WPQA Builder WordPress plugin before 5.9.3 which is a companion plugin used with Discy and Himer Discy WordPress themes incorrectly tries to validate that a user already follows another in the wpqafollowingyouajax action, allowing a user to inflate their score on the site by having another us...
Improper Input Validation
slixmpp is vulnerable to improper input validation. The vulnerability exists in xmlstream.py, which allows an attacker to access the system and perform unauthorized actions due to improper SSL certificate hostname validation...
Unspecified Vulnerability in IBM Sterling B2B Integrator
IBM Sterling B2B Integrator is a suite of software from International Business Machines IBM that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A security vulnerability exists i...
SUSE: Security Advisory (SUSE-SU-2023:0032-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2023-0088
The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on several AJAX actions handling page creation and deletion among other things. This makes it possible for...
CVE-2023-0088
The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on several AJAX actions handling page creation and deletion among other things. This makes it possible for...
Cross site request forgery (csrf)
The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on several AJAX actions handling page creation and deletion among other things. This makes it possible for...
CVE-2023-0088 Swifty Page Manager <= 3.0.1 - Cross-Site Request Forgery
The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on several AJAX actions handling page creation and deletion among other things. This makes it possible for...