WordPress Stockdio Historical Chart plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress Stockdio Historical Chart plugin versions prior to 2.8....

Stockdio Historical Chart < 2.8.1 - Reflected Cross-Site Scripting (XSS)

The plugin was affected by a Reflected Cross-Site Scripting issue via the postMessage event. PoC Use the following code on another website...

CVE-2020-28707

The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting XSS via stockdiocharthistorical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage event is not validated. The stockdioeventer function listens for an...

CVE-2020-28707

The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting XSS via stockdiocharthistorical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage event is not validated. The stockdioeventer function listens for an...

Cross site scripting

The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting XSS via stockdiocharthistorical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage event is not validated. The stockdioeventer function listens for an...

CVE-2020-28707

The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting XSS via stockdiocharthistorical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage event is not validated. The stockdioeventer function listens for an...

CVE-2020-28707

CVE-2020-28707 affects the Stockdio Historical Chart plugin for WordPress (pre-2.8.1). The root cause is an unvalidated origin for postMessage events in stockdio_chart_historical-wp.js, allowing an attacker on a different site to post crafted messages that are eval’d via data.method. Impact is Cr...

WordPress Stockdio Historical Chart plugin 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress Stockdio Historical Chart plugin versions prior to 2.8....

WordPress Stockdio Historical Chart plugin <= 2.7.2 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by Jondow in WordPress Stockdio Historical Chart plugin versions = 2.7.2. Solution Update the WordPress Stockdio Historical Chart plugin to the latest available version at least 2.8.1...

Memory Corruption Vulnerability in AutoShop V4.0.5.0 Timing Monitor Map

Shenzhen Huichuan Technology Co., Ltd. focuses on the research and development, production and sales of industrial automation control products, positioning itself to serve the middle and high-end equipment manufacturers, based on the industrial automation control technology with independent...

Apache Airflow 代码问题漏洞

Apache Airflow is an open source tool for orchestrating complex computational workflows and data processing pipelines. A server-side request forgery vulnerability exists in the Chart and Query View of the old UI in Apache Airflow versions prior to 1.10.13. No details of the vulnerability are...

GHSA-384W-5V3F-Q499 Base class whitelist configuration ignored in OAuthenticator

Impact What goes wrong? The deprecated in jupyterhub 1.2 configuration Authenticator.whitelist, which should be transparently mapped to Authenticator.allowedusers with a warning, is instead ignored by OAuthenticator classes, resulting in the same behavior as if this configuration has not been set...

December 1, 2020, update for Office 2016 (KB4486668)

None None...

Cross-site Scripting (XSS) - Generic in alibaba/bizcharts

Description bizcharts is vulnerable to Cross-Site Scripting XSS. Steps To Reproduce-: 1. Open NPM repo https://www.npmjs.com/package/bizcharts 2. Open the demo https://bizcharts.net/product/BizCharts4/gallery 3. Select any chartI used pie chart Ex: https://bizcharts.net/product/BizCharts4/demo/37...

CVE-2020-26518

Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandoraconsole/include/chartgenerator.php sessionid parameter...

CVE-2020-26518

Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandoraconsole/include/chartgenerator.php sessionid parameter...

Content Spoofing

github.com/helm/helm is vulnerable to content spoofing. Improper sanitization of the alias field on a Chart.yaml allows an attacker to inject arbitrary information in a chart...

Authorization Bypass

github.com/helm/helm is vulnerable to authorization bypass. An attacker with write access to a repository index file is able to inject a malicious chart into a repository...

CVE-2020-15184

In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the alias field on a Chart.yaml is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review th...

CVE-2020-15184

In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the alias field on a Chart.yaml is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review th...