2677 matches found
CVE-2023-49771
CVE-2023-49771 affects the WordPress plugin Smart External Link Click Monitor [Link Log] up to version 5.0.2. Descriptions across sources confirm an improper neutralization of input leading to Reflected XSS, exploitable by unauthenticated users. No patch is available; PatchStack notes no fixed ve...
CVE-2023-49770 WordPress Smart External Link Click Monitor [Link Log] Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Peter Raschendorfer Smart External Link Click Monitor Link Log allows Stored XSS.This issue affects Smart External Link Click Monitor Link Log: from n/a through 5.0.2...
CVE-2023-49770
CVE-2023-49770: Stored XSS in WordPress Smart External Link Click Monitor (Link Log)
PT-2023-31340 · Unknown · Smart External Link Click Monitor [Link Log]
Name of the Vulnerable Software and Affected Versions: Smart External Link Click Monitor Link Log versions n/a through 5.0.2 Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker...
Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Dec 2023)
This host is missing a critical security update according to Microsoft Office Click-to-Run update December 2023 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
WordPress Smart External Link Click Monitor [Link Log] Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS)
Software Smart External Link Click Monitor Link Log Type Plugin Vulnerable versions = 5.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49770 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 442bf3e1fada Credits Mika Required...
WordPress Smart External Link Click Monitor [Link Log] Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS)
Software Smart External Link Click Monitor Link Log Type Plugin Vulnerable versions = 5.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49771 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1106b9604760 Credits Mika...
Click Jacking
firefox is vulnerable to Click Jacking. The vulnerability is caused due to black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. This can be exploited to make users click where the permission grant button would be about to appear...
Simple 301 Redirects < 2.0.8 - Cross-Site Request Forgery via 'clicked'
Description The Simple 301 Redirects plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the 'clicked' function. This makes it possible for unauthenticated attackers to enable or disable...
CVE-2023-6211
If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked the user into clicking to grant an HTTPS-only exception if they could get the user to participate in a clicking game. This vulnerability affects Firefox 120...
Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Nov 2023)
This host is missing a critical security update according to Microsoft Office Click-to-Run update November 2023 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
CVE-2023-47801
An issue was discovered in Click Studios Passwordstate before 9811. Existing users Security Administrators could use the System Wide API Key to read or delete private password records when specifically used with the PasswordHistory API endpoint. It is also possible to use the Copy/Move Password...
Default credentials
An issue was discovered in Click Studios Passwordstate before 9811. Existing users Security Administrators could use the System Wide API Key to read or delete private password records when specifically used with the PasswordHistory API endpoint. It is also possible to use the Copy/Move Password...
CVE-2023-47801
An issue was discovered in Click Studios Passwordstate before 9811. Existing users Security Administrators could use the System Wide API Key to read or delete private password records when specifically used with the PasswordHistory API endpoint. It is also possible to use the Copy/Move Password...
CVE-2023-47801
CVE-2023-47801 affects Click Studios Passwordstate prior to 9811. The issue allows existing Security Administrators to misuse the System Wide API Key (when used with the PasswordHistory endpoint) to read or delete private password records, and to misuse the Copy/Move Password Record API Key to co...
YouTube shows ads for ad blocker, financial scams
After performing local experiments for a few months, YouTube recently expanded its effort to block ad blockers. The move was immediately unpopular with some users, and raised some questions in Europe about whether it was breaking privacy laws. In addition, there are some still some fundamental...
WhatsApp Introduces New Privacy Feature to Protect IP Address in Calls
Meta-owned WhatsApp is officially rolling out a new privacy feature in its messaging service called "Protect IP Address in Calls" that masks users' IP addresses to other parties by relaying the calls through its servers. "Calls are end-to-end encrypted, so even if a call is relayed through WhatsA...
November 7, 2023, update for Outlook 2016 (KB5002523)
None None...
Sql injection
The History Log by click5 WordPress plugin before 1.0.13 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when using the Smash Balloon Social Photo Feed plugin alongside it...