RHSA-2008:0201 Red Hat Security Advisory: redhat-ds-admin security update

Bulletin has no description...

CVE-2024-33830

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/readDeal.php?mudi=clearWebCache...

CVE-2024-2405 Float menu < 6.0.1 - Menu Deletion via CSRF

The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack...

CVE-2024-2449

CVE-2024-2449 describes a cross-site request forgery in Kemp LoadMaster. An authenticated LoadMaster administrator, who knows the IP/hostname, can be lured to a malicious site where a CSRF payload issues HTTP transactions on behalf of the admin. The core impact is unauthorized actions performed i...

Post SMTP < 2.8.7 - Admin+ SQL Injection

Description The plugin does not properly sanitise and escape several parameters before using them in SQL statements, leading to a SQL injection exploitable by high privilege users such as admin. In ps-delete-email-logs action: Visit the Post SMTP Email Log page and run the following code in the...

Authentication Bypass

Pimcore/admin-ui-classic-bundle is vulnerable to an Authentication Bypass. The vulnerability exists in the shouldPerformTwoFactorAuthentication function in PimcoreUserTwoFactorCondition.php because it does not properly check whether the two-factor authentication which allows an attacker to bypass...

PT-2023-19008 · WordPress · Chp Ads Block Detector

Name of the Vulnerable Software and Affected Versions: CHP Ads Block Detector plugin for WordPress versions up to, and including, 3.9.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the chp abd action function. This allows...

CVE-2022-37250

Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting XSS in /admin/myaccount...

Scroll To Top < 1.4.1 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Put the following payload in the "Text" settings of the plugin...

CVE-2022-1790

The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

Media-Tags <= 3.2.0.2 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape any of its Labels settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtnl capability is disallowed. https://drive.google.com/file/d/1ZXIS-q2fzZhRhTyHpHEzxcZ2Shl4Up2/view?usp=sharing Put the...

GHSA-V2WC-PFQ2-5CM6 Possible XSS attack in Wagtail

Impact A cross-site scripting XSS vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges,...

CVE-2020-10443

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-article-printed.php by adding a question mark ? followed by the payload...

CVE-2020-10400

CVE-2020-10400 involves a Reflected XSS in Chadha PHPKB Standard Multi-Language 9 caused by how URIs are processed in admin/header.php. The Red Hat advisories confirm the flaw can be triggered via the URI by adding a question mark and payload, with documented impact on multiple admin pages (e.g.,...

CVE-2019-12863

CVE-2019-12863 affects SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4). The vulnerability is a stored HTML injection via the Web Console Settings screen, reported as an input/output issue in the web interface and attributable to administrators being able to inject HTML. The availab...

The vulnerability of the fly-admin-security-monitor component in the FLY operating system environment of the Astra Linux platform allows a perpetrator to compromise data integrity, gain unauthorized access to protected information, and cause service interruptions.

The vulnerability of the fly-admin-security-monitor component in the FLY operating environment of the Astra Linux system is related to the absence of blocking mechanisms for system commands, as well as the absence of a configuration status for the closed-programming-environment security system...

Cross site scripting

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

Shopify: Preview bar: Incomplete message origin validation results in XSS

The JavaScript code at https://cdn.shopify.com/s/assets/storefront/bars/previewbarinjector-73a4756a265c637c998799750759ae548e7f68b136e8e93e83132904afc3d30d.js loaded by the shop front when a theme is previewed installs a message event listener. The following check is used to reject invalid event...

RobotStats 1.0 Cross Site Scripting

Title : RobotStats v1.0 HTML Injection Vulnerability Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Twitter : https://twitter.com/milw00rm or @milw00rm Date : 22.11.2014 Demo : http://alpesoiseaux.free.fr/robotstats/ Download :...

Disqus for Wordpress 2.7.5 Admin Stored CSRF and XSS

No description provided by source. !-- Exploit for Disqus for Wordpress admin stored CSRF+XSS up to v2.7.5 Blog post explainer: https://www.nikcub.com/posts/multiple-vulnerabilities-in-disqus-wordpress-plugin/ 12th August 2014 Nik Cubrilovic - www.nikcub.com Most of these params are...