6730 matches found
CVE-2022-46408
Ericsson Network Manager ENM, versions prior to 22.1, contains a vulnerability in the application Network Connectivity Manager NCM where improper Neutralization of Formula Elements in a CSV File can lead to remote code execution or data leakage via maliciously injected hyperlinks. The attacker...
CVE-2022-46407
Ericsson Network Manager ENM, versions prior to 22.2, contains a vulnerability in the REST endpoint “editprofile” where Open Redirect HTTP Header Injection can lead to redirection of the submitted request to domain out of control of ENM deployment. The attacker would need admin/elevated access to...
PT-2023-3347
Name of the Vulnerable Software and Affected Versions: Arcserve UDP versions 7.0 through 9.0.6034 Description: The issue allows authentication bypass, enabling an attacker to obtain a valid session and execute tasks as an administrator. This is achieved by exploiting the getVersionInfo method at...
PT-2023-11498 · Unknown · Chaoji Cms
Name of the Vulnerable Software and Affected Versions: Chaoji CMS version 2.18 Description: A stored cross site scripting XSS issue in the /index.php?admin-master-article-edit endpoint of Chaoji CMS allows attackers to obtain administrator privileges. Recommendations: For Chaoji CMS version 2.18,...
CVE-2023-28988
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PI Websolution Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, Quick View button for WooCommerce plugin = 2.1.48 versions...
Cross site scripting
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PI Websolution Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, Quick View button for WooCommerce plugin = 2.1.48 versions...
PT-2023-22068 · WordPress · Woocommerce
Name of the Vulnerable Software and Affected Versions: WooCommerce plugin versions prior to 3.0.19 Description: A Stored Cross-Site Scripting XSS vulnerability exists, allowing authenticated administrators to inject malicious scripts. This issue affects the PI Websolution Order date, Order pickup...
The vulnerability of the GLPI system’s request and incident handling process, related to improper management of privileges, allows a perpetrator to escalate their privileges within the application.
The vulnerability of the GLPI application for handling requests and incidents is related to improper management of privileges. An authenticated user can change the email addresses of any other user in the application, including the administrator’s email address. Exploiting this vulnerability allo...
CVE-2023-34203
In Progress OpenEdge OEM OpenEdge Management and OEE OpenEdge Explorer before 12.7, a remote user who has any OEM or OEE role could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and...
CVE-2023-34203
In Progress OpenEdge OEM OpenEdge Management and OEE OpenEdge Explorer before 12.7, a remote user who has any OEM or OEE role could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and...
CVE-2023-34203
In Progress OpenEdge OEM OpenEdge Management and OEE OpenEdge Explorer before 12.7, a remote user who has any OEM or OEE role could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and...
CVE-2023-34170
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Overnight Quick/Bulk Order Form for WooCommerce plugin = 3.5.7 versions...
CVE-2023-34170 WordPress Quick/Bulk Order Form for WooCommerce Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Overnight Quick/Bulk Order Form for WooCommerce plugin = 3.5.7 versions...
CVE-2023-33323
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Repute InfoSystems ARMember plugin = 4.0.2 versions...
CVE-2023-28778
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in BestWebSoft Pagination plugin = 1.2.2 versions...
CVE-2023-28778
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in BestWebSoft Pagination plugin = 1.2.2 versions...
CVE-2023-28423
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Prism Tech Studios Modern Footnotes plugin = 1.4.15 versions...
PT-2023-24708 · WordPress · Wp Overnight Quick/Bulk Order Form For Woocommerce
Name of the Vulnerable Software and Affected Versions: WP Overnight Quick/Bulk Order Form for WooCommerce plugin versions = 3.5.7 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For WP...
PT-2023-21911 · Unknown · Vigilantor
Name of the Vulnerable Software and Affected Versions: Drew Phillips VigilanTor plugin versions prior to 1.3.11 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with admin+ authentication. This type of vulnerability allows an attacker to inje...