CVE-2019-5984

Cross-site request forgery CSRF vulnerability in Custom CSS Pro 1.0.3 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Custom CSS Pro 1.0.3 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2019-5984

Cross-site request forgery CSRF vulnerability in Custom CSS Pro 1.0.3 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2019-5984

The CVE-2019-5984 entry concerns the WordPress plugin Custom CSS Pro (versions ≤ 1.0.3). The root issue is a cross-site request forgery (CSRF) that can allow remote attackers to hijack administrator sessions, enabling unauthorized actions when a logged-in admin views a malicious page. Public sour...

PT-2019-17918 · Unknown · Custom Css Pro

Name of the Vulnerable Software and Affected Versions: Custom CSS Pro versions 1.0.3 and earlier Description: A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators. The attack vectors are not specified. Recommendations: For Custom CSS Pro versio...

CVE-2019-5984: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Custom CSS Pro 1.0.3 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

WordPress Ocean Extra plugin <= 1.5.8 - Unauthenticated CSS injection vulnerability

Unauthenticated CSS injection vulnerability found by Jerome Bruandet in WordPress Ocean Extra plugin versions = 1.5.8. Solution Update the WordPress Ocean Extra plugin to the latest available version at least 1.5.9...

Ocean Extra <= 1.5.8 - Unauthenticated Settings change and CSS injection

The Ocean Extra WordPress plugin was affected by an Unauthenticated Settings change and CSS injection security vulnerability...

Valve: Panorama UI XSS leads to Remote Code Execution via Kick/Disconnect Message

Overview Counter-Strike: Global Offensive's UI is built of a framework called Panorama which is heavily influenced by modern HTML/CSS with JS capabilities. Because of these properties, the UI becomes easily vulnerable to different types of code injection, most notably XSS. Previously, it was...

WordPress Plugin "Custom CSS Pro" vulnerable to cross-site request forgery

Overview WordPress Plugin "Custom CSS Pro" provided by WaspThemes contains a cross-site request forgery vulnerability CWE-352. Dai Nakamura of Cryptography Laboratory,Department of Information and Communication Engineering,Tokyo Denki University directly reported this vulnerability to the develop...

JVN#29933378: WordPress Plugin "Custom CSS Pro" vulnerable to cross-site request forgery

WordPress Plugin "Custom CSS Pro" provided by WaspThemes contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, unintended operations may be performed. Solution Update the plugin Update the plugin according to the information provided...

Custom CSS Pro <= 1.0.3 - CSRF & XSS

The Custom CSS Pro WordPress plugin was affected by a CSRF & XSS security vulnerability...

WordPress Custom CSS Pro plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Custom CSS Pro plugin is a CSS editor plugin used in it. A cross-site request forgery vulnerability exists in WordPress Custom CSS Pro...

openSUSE Security Update : libcroco (openSUSE-2019-1575)

This update for libcroco fixes the following issues : Security issues fixed : - CVE-2017-7960: Fixed heap overflow input: check end of input before reading a byte bsc1034481. - CVE-2017-7961: Fixed undefined behavior tknzr: support only max long rgb values bsc1034482. - CVE-2017-8834: Fixed denia...

Debian DLA-1825-1 : kdepim security update

A reply-based decryption oracle was found in kdepim, which provides the KMail e-mail client. An attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline character...

cssfontstack.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-861959 Security Researcher geeknik Helped patch 8675 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting cssfontstack.com website an...

SUSE-SU-2019:1468-1 Security update for libcroco

This update for libcroco fixes the following issues: Security issues fixed: - CVE-2017-7960: Fixed heap overflow input: check end of input before reading a byte bsc1034481. - CVE-2017-7961: Fixed undefined behavior tknzr: support only max long rgb values bsc1034482. - CVE-2017-8834: Fixed denial ...

@allenbrowntech/lemon (>=1.0.0, <=1.6.0), @biotope/build (>=5.2.0, <=5.2.3) +82 more potentially affected by unknown CVE via clean-css (>=4.0.2, <=4.1.9)

clean-css NPM version =4.0.2, =1.0.0, =5.2.0, =1.6.1, =1.0.0, =1.0.0, =2.0.1, =1.0.0-201702012110, =0.0.17, =1.0.8, =0.0.2, =0.13.0-beta.1, =0.0.1, =1.3.3, =0.1.0, =0.0.3, =0.0.10 and more Source cves: unknown CVE Source advisory: GHSA-WXHQ-PM8V-CW75...

GHSA-WXHQ-PM8V-CW75 Regular Expression Denial of Service in clean-css

Version of clean-css prior to 4.1.11 are vulnerable to Regular Expression Denial of Service ReDoS. Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service. Recommendation Upgrade to...

@allenbrowntech/lemon (>=1.0.0, <=1.6.0), @biotope/build (>=5.2.0, <=5.2.3) +82 more potentially affected by unknown CVE via clean-css (>=4.0.2, <=4.1.9)

clean-css NPM version =4.0.2, =1.0.0, =5.2.0, =1.6.1, =1.0.0, =1.0.0, =2.0.1, =1.0.0-201702012110, =0.0.17, =1.0.8, =0.0.2, =0.13.0-beta.1, =0.0.1, =1.3.3, =0.1.0, =0.0.3, =0.0.10 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WXHQ-PM8V-CW75...