5684 matches found
CVE-2023-0418
The Video Central for WordPress plugin through 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Cross site scripting
The Video Central for WordPress plugin through 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-0418
CVE-2023-0418 affects the Video Central for WordPress plugin up to version 1.3.0. The vulnerability is a Stored XSS due to insufficient validation and escaping of certain shortcode attributes when output in pages/posts that embed the shortcode. Impact is limited to users with contributor role and...
Russian Hackers Tomiris Targeting Central Asia for Intelligence Gathering
The Russian-speaking threat actor behind a backdoor known as Tomiris is primarily focused on gathering intelligence in Central Asia, fresh findings from Kaspersky reveal. "Tomiris's endgame consistently appears to be the regular theft of internal documents," security researchers Pierre Delcher an...
Russian Hackers Tomiris Targeting Central Asia for Intelligence Gathering
The Russian-speaking threat actor behind a backdoor known as Tomiris is primarily focused on gathering intelligence in Central Asia, fresh findings from Kaspersky reveal. "Tomiris's endgame consistently appears to be the regular theft of internal documents," security researchers Pierre Delcher an...
WordPress plugin Video Central 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
PT-2023-16256 · WordPress · The Video Central For Wordpress
Name of the Vulnerable Software and Affected Versions: The Video Central for WordPress plugin through 1.3.0 Description: The issue concerns a lack of validation and escaping of certain shortcode attributes in the plugin, which could allow users with the contributor role and above to perform Store...
Ivanti Avalanche FileStoreConfig File Upload
Ivanti Avalanche prior to v6.4.0.186 permits MS-DOS style short names in the configuration path for the Central FileStore. Because of this, an administrator can change the default path to the web root of the applications, upload a JSP file, and achieve RCE as NT AUTHORITY\SYSTEM. Module Options m...
Security Bulletin: Vulnerabilities in Apache Shiro (CVE-2022-40664) and Apache Commons FileUpload (CVE-2023-24998) affect IBM WebSphere Service Registry and Repository.
Summary A bypass security restrictions vulnerability in Apache Shiro CVE-2022-40664 and a denial of service vulnerability in Apache Commons File Upload CVE-2023-24998 affect IBM WebSphere Service Registry and Repository. Vulnerability Details CVEID:CVE-2022-40664 DESCRIPTION: Apache Shiro could...
CVE-2023-24504
Electra Central AC unit – Adjacent attacker may cause the unit to connect to unauthorized update server...
CVE-2023-24502
Electra Central AC unit – The unit opens an AP with an easily calculated password...
CVE-2023-24500
Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW...
CVE-2023-24503
Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW...
CVE-2023-24501
Electra Central AC unit – Hardcoded Credentials in unspecified code used by the unit...
CVE-2023-24500
Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW...
CVE-2023-24501
Electra Central AC unit – Hardcoded Credentials in unspecified code used by the unit...
CVE-2023-24504
Electra Central AC unit – Adjacent attacker may cause the unit to connect to unauthorized update server...
CVE-2023-24503
Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW...