PT-2023-18515 · Kubepi · Kubepi

Name of the Vulnerable Software and Affected Versions: KubePi versions prior to 1.6.3 Description: The jwt authentication function of KubePi uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the...

KubePi 信任管理问题漏洞

KubePi is a K8s panel. It allows administrators to import multiple Kubernetes clusters and assign permissions for different clusters, namespaces to specified users through permission control. KubePi 1.6.2 and prior versions have a trust management issue vulnerability that stems from its jwt...

CVE-2022-41266

Due to a lack of proper input validation, SAP Commerce Webservices 2.0 Swagger UI - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site Scripting XSS attack. As a result, an attacker may be able t...

PT-2022-27762

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2022.11.2 authentik versions prior to 2022.10.2 Description authentik is an open-source identity provider. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that...

GHSA-CM7F-HF2G-GHRP PyroCMS vulnerable to stored Cross Site Scripting

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting XSS when a low privileged user, such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation...

CVE-2022-37720

Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting XSS. When a low privileged user such as an author or publisher, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation when the malicious blog post is load...

PyroCMS 跨站脚本漏洞

PyroCMS is an individual developer's a lightweight open source content management system developed using the CodeIgniter framework. A security vulnerability exists in PyroCMS version 3.9, which stems from the ability of a low-privileged user such as an author or publisher to inject a carefully...

PT-2022-24048 · Orchardproject · Orchard Cms

Name of the Vulnerable Software and Affected Versions: Orchardproject Orchard CMS version 1.10.3 Description: The issue allows a low-privileged user, such as an author or publisher, to inject crafted HTML and JavaScript payload in a blog post. This leads to full admin account takeover or privileg...

CVE-2022-37721

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting XSS when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation...

CVE-2022-37721

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting XSS when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation...

CVE-2022-37914

Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass authentication. Successful exploitation of these vulnerabilities could allow an attacker to gain administrative privileges leading to a...

Design/Logic Flaw

The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import intentionally or not a malicious file and a suitable gadget chain is present on the blog...

UBUNTU-CVE-2022-35957

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All...

PT-2022-20940 · Nortek Linear · Nortek Linear Emerge E3-Series

Name of the Vulnerable Software and Affected Versions: Nortek Linear eMerge E3-Series version 0.32-07p Description: The issue allows an attacker to take over an admin account or a user account through a combination of XSS and session fixation via the PHPSESSID when devices are chained together...

CVE-2022-2355 Easy Username Updater < 1.0.5 - Arbitrary Username Update via CSRF

The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin...

CVE-2022-23074

In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in the ‘Name’ field of Keyword, Food and Unit components. When a victim accesses the Keyword/Food/Unit endpoints, the XSS payload will trigger. A low privileged attacker will have the victim's API key and...

CVE-2022-23074

In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in the ‘Name’ field of Keyword, Food and Unit components. When a victim accesses the Keyword/Food/Unit endpoints, the XSS payload will trigger. A low privileged attacker will have the victim's API key and...

Cross site scripting

In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in the ‘Name’ field of Keyword, Food and Unit components. When a victim accesses the Keyword/Food/Unit endpoints, the XSS payload will trigger. A low privileged attacker will have the victim's API key and...

Cross site scripting

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in copy to clipboard functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the clipboard icon, an XSS...

CVE-2022-23072

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an X...