7214 matches found
CVE-2022-45821
CVE-2022-45821: Stored Cross-Site Scripting in NooTheme Noo Timetable plugin
CVE-2023-23880
CVE-2023-23880: ExactMetrics WordPress plugin
Cross site scripting
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in NsThemes NS Coupon To Become Customer plugin = 1.2.2 versions...
CVE-2023-25459
CVE-2023-25459 affects the WordPress plugin Post Snippets (Postsnippets) up to v4.0.2. It is an admin-authenticated stored XSS via the snippet_content field; patch to v4.0.3. CVSS/impact details vary by source (NVD/Wordfence/Patchstack report low-to-medium risk; documented exploitation not provid...
CVE-2023-27416 WordPress Decon WP SMS Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Decon Digital Decon WP SMS plugin = 1.1 versions...
CVE-2023-39349
Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query /api/0/api-tokens/ for a list of all tokens created by a user, including tokens with greater scopes, and use...
Code injection
Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query /api/0/api-tokens/ for a list of all tokens created by a user, including tokens with greater scopes, and use...
CVE-2023-39349 Sentry vulnerable to privilege escalation via ApiTokensEndpoint
Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query /api/0/api-tokens/ for a list of all tokens created by a user, including tokens with greater scopes, and use...
CVE-2023-34377
CVE-2023-34377 is a stored XSS vulnerability in the WordPress plugin My Content Management by Joseph C Dolson , affecting versions up to and including 1.7.6 . The issue requires admin+ authentication to exploit and is described as a stored XSS affecting user input handling. Public CVSS metrics va...
CVE-2023-34377 WordPress My Content Management Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Joseph C Dolson My Content Management plugin = 1.7.6 versions...
CVE-2023-38688
twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including...
Design/Logic Flaw
twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including...
CVE-2023-38688 twitch-tui's connection is not encrypted
twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including...
Virtual Snipers DMS 1.0 SQL Injection
==================================================================================================================================== | Title : Virtual Snipers DMS v1.0 Auth by pass Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...
Exploit for CVE-2023-38646
CVE-2023-38646 - Metabase Pre-auth RCE !Untitled presentatio...
CVE-2023-3462
A flaw was found in the HashiCorp Vault. The Vault and Vault Enterprise “Vault” LDAP auth method allows unauthenticated users to potentially enumerate valid accounts in the configured LDAP system by observing the response error when querying usernames...
CVE-2023-3462 Vault's LDAP Auth Method Allows for User Enumeration
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed i...
GHSA-779W-XVPM-78JX twitch-tui's connection is not encrypted
Summary The connection is not using TLS for communication Details In the configuration of the irc connection, you are disabling tls which makes all communication to twitch irc servers unencrypted. PoC You can verify by using tcpdump/wireshark that traffic is unencrypted. Impact Communication can ...
CVE-2023-34644
Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW3.01B11P204, RG-NBS and RG-S1930 series switches SWITCH3.01B11P218, RG-EG series business VPN routers EG3.01B11P216, EAP and RAP series wireless access points AP3.01B11P218, NBC series wirele...