7249 matches found
Open Redirect
@keystone-6/auth is vulnerable to Open Redirect. The vulnerability exists due to improper path sanitization which can result in users being redirected to domains other than the relative host by bypassing the / filter...
CVE-2023-24030
An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0 and 8.8.15. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a us...
CVE-2023-25972
CVE-2023-25972 affects the WordPress Старт plugin by IKSWEB, with a stored XSS vulnerability in versions
PyLoad 0.5.0 Remote Code Execution
Exploit Title: PyLoad 0.5.0 - Pre-auth Remote Code Execution RCE Date: 06-10-2023 Credits: bAu @bauh0lz Exploit Author: Gabriel Lima 0xGabe Vendor Homepage: https://pyload.net/ Software Link: https://github.com/pyload/pyload Version: 0.5.0 Tested on: Ubuntu 20.04.6 CVE: CVE-2023-0297 import...
@keystone-6/auth Open Redirect vulnerability
Summary There is an open redirect in the @keystone-6/auth package, where the redirect leading / filter can be bypassed. Impact Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. Mitigations - Don't u...
PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
Exploit Title: PyLoad 0.5.0 - Pre-auth Remote Code Execution RCE Date: 06-10-2023 Credits: bAu @bauh0lz Exploit Author: Gabriel Lima 0xGabe Vendor Homepage: https://pyload.net/ Software Link: https://github.com/pyload/pyload Version: 0.5.0 Tested on: Ubuntu 20.04.6 CVE: CVE-2023-0297 import...
CVE-2023-34247
Keystone is a content management system for Node.JS. There is an open redirect in the @keystone-6/auth package versions 7.0.0 and prior, where the redirect leading / filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to...
Open redirect
Keystone is a content management system for Node.JS. There is an open redirect in the @keystone-6/auth package versions 7.0.0 and prior, where the redirect leading / filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to...
CVE-2023-34247 @keystone-6/auth Open Redirect vulnerability
Keystone is a content management system for Node.JS. There is an open redirect in the @keystone-6/auth package versions 7.0.0 and prior, where the redirect leading / filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to...
CVE-2023-34247
Keystone is a Node.js-based CMS. There is an Open Redirect in the @keystone-6/auth package up to version 7.0.0, where the redirect leading '/' filter can be bypassed. An attacker may cause users to be redirected to external domains instead of the relative host. Remediation is to apply the patch f...
CVE-2023-26538 WordPress Chat Bee Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Kamyabsoft Chat Bee plugin = 1.1.0 versions...
CVE-2023-26538
CVE-2023-26538 is a Stored XSS in the Kamyabsoft Chat Bee WordPress plugin, affecting versions prior to 1.1.0. The vulnerability requires authentication with admin+ privileges and originates from how input is stored/executed in the plugin. Affected software: Kamyabsoft Chat Bee plugin (WordPress)...
CVE-2023-25964 WordPress We’re Open! Plugin <= 1.46 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Noah Hearle, Design Extreme We’re Open! plugin = 1.46 versions...
CVE-2023-23831 WordPress Rating Widget Plugin <= 3.1.9 is vulnerable to Cross Site Scripting (XSS)
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Rating-Widget Rating-Widget: Star Review System plugin = 3.1.9 versions...
Cross-site Scripting (XSS)
github.com/rancher/rancher is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the Projects/Namespaces and Auth Provider sections, which allows an attacker with write access to inject and execute malicious code and steal sensitive information, manipulate web content, or perform...
CVE-2023-30745
CVE-2023-30745 affects the WordPress plugin IP Metaboxes (Phan Chuong) ≤ 2.1.1. An authenticated admin+ can trigger a Stored XSS due to inadequate sanitization/escaping of settings, potentially affecting admin sessions and loaded pages. The connected documents provide limited detail on exploit st...
CVE-2023-30745 WordPress IP Metaboxes Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Phan Chuong IP Metaboxes plugin = 2.1.1 versions...
CVE-2023-23822
CVE-2023-23822 affects the WordPress plugin UTM Tracker (Ludwig Media)