1749 matches found
Multi-column Tag Map < 17.0.25 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Malicious Package
Overview column-chart-web is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...
WordPress eVision Responsive Column Layout Shortcodes Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)
Software eVision Responsive Column Layout Shortcodes Type Plugin Vulnerable versions = 2.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 18ded12f9366 Credits...
postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names
A flaw was found in PostgresQL. This flaw allows an attacker to benefit from a miss escaping character and leads to a SQL injection attack due to Java.sql.ResultRow.refreshRow implementation from PGSQL...
Global Education And Technoworld 4.1 Backup Disclosure
==================================================================================================================================== | Title : GLOBAL EDUCATION & TECHNOWORLD Version 4.1 unauthorized backup download Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.10Pro /...
Fortinet FortiPortal 跨站脚本漏洞
Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi and FortiAP product lines, available as a virtual machine for MSPs. attacker could exploit the vulnerability to execute stored cross-site scripting by sending...
postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names
A flaw was found in PostgresQL. This flaw allows an attacker to benefit from a miss escaping character and leads to a SQL injection attack due to Java.sql.ResultRow.refreshRow implementation from PGSQL...
vim: Fix of 2 CVEs
CVE-2022-4141: check for text locked in CTRL-W gf - CVE-2022-3520: check that the column does not become negative...
CLSA-2022-1670874574 vim: Fix of 2 CVEs
CVE-2022-4141: check for text locked in CTRL-W gf - CVE-2022-3520: check that the column does not become negative...
CLSA-2022-1670874310 Fix CVE(s): CVE-2022-4141, CVE-2022-3520
SECURITY UPDATE: With a Visual block a put command column may go negative - debian/patches/CVE-2022-3520.patch: Check that the column does not become negative - CVE-2022-3520 SECURITY UPDATE: Invalid memory access in substitute with function that goes to another file -...
CLSA-2022-1670874212 vim: Fix of 2 CVEs
CVE-2022-4141: check for text locked in CTRL-W gf - CVE-2022-3520: check that the column does not become negative...
CVE-2022-25629
An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executed on the annotations page Annotation Text Column...
CVE-2022-25629: Improper Neutralization of Input During Web Page Generation
An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executed on the annotations page Annotation Text Column...
The vulnerability of the components column.title and cellLinkTooltip in the Grafana data visualization web tool allows a hacker to exploit their privileges.
The vulnerability of the column.title and cellLinkTooltip components of the Grafana data visualization web tool is related to insufficient protection of the website structure. Exploiting this vulnerability could allow a malicious actor to gain increased privileges remotely...
postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names
A flaw was found in PostgresQL. This flaw allows an attacker to benefit from a miss escaping character and leads to a SQL injection attack due to Java.sql.ResultRow.refreshRow implementation from PGSQL...
SQL Injection
moodle/moodle is vulnerable to sql injection attacks. The vulnerability exists in getuserslisting function of datalib.php due to improper implementation of sort helper and column mapping for sort which allows an attacker to inject malicious queries into the system...
Shopxian CMS 跨站请求伪造漏洞
Shopxian CMS is an open source free website builder system for individual developers in China zhangqiquan. A cross-site request forgery vulnerability exists in Shopxian CMS version 3.0.0. An attacker exploits this vulnerability to delete a specified column via...
CVE-2022-38329
A CSRF vulnerability in Shopxian CMS 3.0.0 could allow an unauthenticated, remote attacker to craft a malicious link, potentially causing the administrator to perform unintended actions on an affected system. The vulnerability could allow attackers to modify or delete specific content through...
PT-2022-24370
Name of the Vulnerable Software and Affected Versions Shopxian CMS version 3.0.0 Description A CSRF issue allows deletion of a specified column via the "index.php/contents-admin cat-finderdel-model-ContentsCat.html" endpoint, specifically when the id parameter is set to 17. Recommendations For...
