CVE-2023-6251

Cross-site Request Forgery CSRF in Checkmk 2.2.0p15, 2.1.0p37, = 2.0.0p39 allow an authenticated attacker to delete user-messages for individual users...

Cross site request forgery (csrf)

Cross-site Request Forgery CSRF in Checkmk 2.2.0p15, 2.1.0p37, = 2.0.0p39 allow an authenticated attacker to delete user-messages for individual users...

CVE-2023-6251

Cross-site Request Forgery CSRF in Checkmk 2.2.0p15, 2.1.0p37, = 2.0.0p39 allow an authenticated attacker to delete user-messages for individual users...

UBUNTU-CVE-2023-6251

Cross-site Request Forgery CSRF in Checkmk 2.2.0p15, 2.1.0p37, = 2.0.0p39 allow an authenticated attacker to delete user-messages for individual users...

Checkmk Security Vulnerabilities

Checkmk is an editor. Checkmk has a security vulnerability that stems from the presence of a cross-site request forgery CSRF vulnerability that allows an authenticated attacker to delete a single user's user messages...

PT-2023-32577 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.2.0p15 Checkmk versions prior to 2.1.0p37 Checkmk versions prior to 2.0.0p40 Description: The issue allows an authenticated attacker to delete user-messages for individual users due to a Cross-site Request Forgery...

Elementor Website Builder < 3.16.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_inline_svg()

Description The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the getinlinesvg function in versions up to, and including, 3.16.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Olive One Click Demo Import <= 1.0.9 - Authenticated (Administrator+) Arbitrary File Upload in olive_one_click_demo_import_save_file

Description The Olive One Click Demo Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the oliveoneclickdemoimportsavefile function in versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with...

CVE-2023-6265

UNSUPPORTED WHEN ASSIGNED Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files. Vigor2960 is no longer supported...

CVE-2023-6265

DrayTek Vigor2960 (versions 1.5.1.4–1.5.1.5) is affected by a directory traversal vulnerability in the mainfunction.cgi dumpSyslog option parameter. An authenticated attacker with access to the web management interface can delete arbitrary files on the device. The vulnerability affects only these...

CVE-2023-6265 DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversal

UNSUPPORTED WHEN ASSIGNED Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files. Vigor2960 is no longer supported...

CVE-2023-47251

In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, a Directory Traversal in the print function of the VNC service allows authenticated attackers with access to a VNC session to automatically transfer malicious PDF documents by moving them into the .spool directory, and then...

CVE-2023-20241

Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service DoS condition on an affected system. These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Clie...

CVE-2023-20241

Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service DoS condition on an affected system. These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Clie...

CVE-2023-5465

The Popup with fancybox plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

Cross site scripting

The Sponsors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sponsors' shortcode in all versions up to, and including, 3.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacke...

Design/Logic Flaw

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfaf2triggerdarkmode function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and...

IBM Cloud Pak for Security 信息泄露漏洞

IBM Cloud Pak for Security is an application from International Business Machines IBM, Inc. an open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster. An information disclosure vulnerability exists in IBM Clou...

m-privacy TightGate-Pro Server Security Vulnerability

The m-privacy TightGate-Pro Server is a remote control browser system from the German company m-privacy. A security vulnerability exists in m-privacy TightGate-Pro Server versions prior to 2.0.406g, which originated from a vulnerability that allows an authenticated attacker to automatically...

CVE-2023-20265

A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface on an affected device. This vulnerability is due to insufficient validation ...