112 matches found
WordPress plugin Bricks 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
WordPress Bricksbuilder plugin <= 1.9.6.1 - Authenticated (Contributor+) Privilege Escalation via create_autosave vulnerability
Authenticated Contributor+ Privilege Escalation via createautosave vulnerability discovered by etragardh in WordPress Theme Bricks Builder versions = 1.9.6.1...
Malicious code in sap-autosave (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a51a0bdf3fb114cb90f16633d8b64f1cc27d98a3b06b5e219700bc541a4bf461 The OpenSSF Package Analysis project identified 'sap-autosave' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...
MAL-2024-7595 Malicious code in sap-autosave (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a51a0bdf3fb114cb90f16633d8b64f1cc27d98a3b06b5e219700bc541a4bf461 The OpenSSF Package Analysis project identified 'sap-autosave' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...
GHSA-V626-R774-J7F8 TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes
Impact A mutation cross-site scripting mXSS vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization according to the HTML standard. If such text nodes contain a special character...
TinyMCE -- mXSS in multiple plugins
TinyMCE reports: Special characters in unescaped text nodes can trigger mXSS when using TinyMCE undo/redo, getContentAPI, resetContentAPI, and Autosave plugin...
Cross-site Scripting (XSS)
TinyMCE is vulnerable to Cross-site Scripting XSS. The vulnerability occurs when an HTML snippet is restored from the undo stack. In this situation, a combination of string manipulation and reparative parsing by the browser's native DomParser API results in malicious mutations to the HTML. This, ...
CVE-2023-45818 Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin
TinyMCE is an open source rich text editor. A mutation cross-site scripting mXSS vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a string by internal trimming functions before...
GHSA-V65R-P3VV-JJFV TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin
Impact A mutation cross-site scripting mXSS vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a string by internal trimming functions before being stored in the undo stack. If t...
WordPress AutoSave Net Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)
Software AutoSave Net Type Plugin Vulnerable versions = 1.3.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3520eb9add2b Credits Rafie Muhammad Patchstack Required...
SUSE CVE-2015-5332
Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service disk consumption by leveraging the guest role and entering drafts with the editor-autosave feature...
CVE-2022-36115
An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for unintended functionality. An...
Blue Prism Enterprise 安全漏洞
Blue Prism Enterprise is an intelligent robotic process automation RPA software from Blue Prism UK. A security vulnerability exists in Blue Prism Enterprise versions 6.0 through 7.01, which stems from a misconfigured environment that exposes the Blue Prism application server, which allows an...
A Microsoft Office 365 Feature Could Help Ransomware Hackers Hold Cloud Files Hostage
A "dangerous piece of functionality" has been discovered in Microsoft 365 suite that could be potentially abused by a malicious actor to mount attacks on cloud infrastructure and ransom files stored on SharePoint and OneDrive. The cloud ransomware attack makes it possible to launch file-encryptin...
GHSA-FXPF-JR2Q-VPVV Liferay Portal and Liferay DXP autosaves form data for other users to see
The Dynamic Data Mapping module in Dynamic Data Mapping Form Web before 3.0.23 in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by...
Liferay Portal and Liferay DXP autosaves form data for other users to see
The Dynamic Data Mapping module in Dynamic Data Mapping Form Web before 3.0.23 in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by...
CVE-2021-32961
A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function loo...
CVE-2021-32953
An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user’s permissions, granting the attacker the ability to login...
CVE-2021-32937
An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06. An attacker can leverage this knowledge to provide a malicious command to the working directory where the read and write activity can be...