7928 matches found
WordPress plugin Tawk.To Live Chat 跨站请求伪造漏洞
WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on PHP and MySQL servers. WordPress Tawk.To Live Chat plugin in versions prior to 0.6.0 suffers from a cross-site request forgery...
PT-2021-16364 · WordPress · Tawk.To Live Chat
Name of the Vulnerable Software and Affected Versions: Tawk.To Live Chat WordPress plugin versions prior to 0.6.0 Description: The issue concerns the lack of capability and CSRF checks in the tawkto setwidget and tawkto removewidget AJAX actions, which are available to any authenticated user. Thi...
Sunnet eHRD Insecure Deserialization Vulnerability
Sunnet eHRD is a talent management system from Sun Chat Technology, Taiwan, China. The system supports talent management and performance management, etc. An insecure deserialization vulnerability exists in Sunnet eHRD, which stems from the inadequate input object validation and restriction of the...
CVE-2021-43791
Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmation objects associated with email invitations were not enforced properly in the new account registration flow. A confirmation link takes a...
CVE-2021-43791
Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmation objects associated with email invitations were not enforced properly in the new account registration flow. A confirmation link takes a...
Design/Logic Flaw
Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmation objects associated with email invitations were not enforced properly in the new account registration flow. A confirmation link takes a...
CVE-2021-43791
Zulip 4.x vulnerability (CVE-2021-43791): Expired invitation confirmation keys were not properly validated in the new account registration flow. The check_prereg_key_and_redirect step validated the key, but /accounts/register/ did not, allowing registration with an expired key. Impact: potential ...
Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-90757)
Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited...
Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-90759)
Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited...
Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-90760)
Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited...
WordPress WP Guppy 1.1 Information Disclosure
Exploit Title: Wordpress Plugin WP Guppy 1.1 - WP-JSON API Sensitive Information Disclosure Exploit Author: Keyvan Hardani Date: 22/11/2021 Vendor Homepage: https://wp-guppy.com/ Version: up to 1.1 Tested on: Kali Linux - Windows 10 - Wordpress 5.8.x and apache2 Usage ./exploit.sh -h !/bin/bash...
CVE-2021-33492
OX App Suite 7.10.5 allows XSS via an OX Chat room name...
CVE-2021-33492
OX App Suite 7.10.5 allows XSS via an OX Chat room name...
CVE-2021-33492
OX App Suite 7.10.5 allows XSS via an OX Chat room name...
CVE-2021-33494
OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering...
CVE-2021-33494
OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering...
CVE-2021-33495
OX App Suite 7.10.5 allows XSS via an OX Chat system message...
CVE-2021-33495
OX App Suite 7.10.5 allows XSS via an OX Chat system message...