109576 matches found
CVE-2023-27149
A stored cross-site scripting XSS vulnerability in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Label input parameter when updating a custom list...
kodbox Cross-Site Scripting Vulnerability
kodbox is a web file manager. A security vulnerability exists in kodbox version 1.44, which stems from a custom global HTML that causes XSS...
PT-2023-20974 · Enhancesoft · Osticket
Name of the Vulnerable Software and Affected Versions: Enhancesoft osTicket version 1.17.2 Description: A stored cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Label input parameter when updating a custom...
CVE-2023-5205
The Add Custom Body Class plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'addcustombodyclass' value in versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress Add Custom Body Class Plugin <= 1.4.1 is vulnerable to Cross Site Scripting (XSS)
Software Add Custom Body Class Type Plugin Vulnerable versions = 1.4.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5205 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 55c282d5e4c0 Credits Francesco Carlucci...
WordPress Plugin Add Custom Body Class Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
CVE-2021-4418
The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to save code snippets via a forged...
CVE-2021-4418 Custom CSS, JS & PHP <= 2.0.7 - Cross-Site Request Forgery Bypass
The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to save code snippets via a forged...
CVE-2021-4418 Custom CSS, JS & PHP <= 2.0.7 - Cross-Site Request Forgery Bypass
The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to save code snippets via a forged...
PT-2023-32013 · WordPress · Advanced Custom Fields: Extended
Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields: Extended plugin for WordPress versions up to, and including, 0.8.9.3 Description: The issue is related to Stored Cross-Site Scripting via the 'acfe form' shortcode due to insufficient input sanitization and output...
WordPress Plugin Advanced Custom Fields: Extended Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
CLSA-2023-1697741983 python3: Fix of CVE-2022-48560
CVE-2022-48560: fix posible crash in heapq with custom comparison operators...
CLSA-2023-1697741309 python3: Fix of CVE-2022-48560
CVE-2022-48560: fix posible crash in heapq with custom comparison operators...
CLSA-2023-1697740683 python3: Fix of CVE-2022-48560
CVE-2022-48560: fix posible crash in heapq with custom comparison operators...
CVE-2023-45825 Token in custom credentials object can leak through logs in ydb-go-sdk
ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object implementation of interface Credentials it may leak into logs. This happens because this object could be serialized into an error message using...
CVE-2023-45825 Token in custom credentials object can leak through logs in ydb-go-sdk
ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object implementation of interface Credentials it may leak into logs. This happens because this object could be serialized into an error message using...
GHSA-Q24M-6H38-5XJ8 ydb-go-sdk token in custom credentials object can leak through logs
Impact Since ydb-go-sdk/v3.48.6 if you use a custom credentials object implementation of interface Credentials it may leak into logs. This happens because this object could be serialized into an error message using fmt.Errorf"something went wrong credentials: %q", credentials during connection to...
ydb-go-sdk token in custom credentials object can leak through logs
Impact Since ydb-go-sdk/v3.48.6 if you use a custom credentials object implementation of interface Credentials it may leak into logs. This happens because this object could be serialized into an error message using fmt.Errorf"something went wrong credentials: %q", credentials during connection to...
WordPress Just Custom Fields Plugin <= 3.3.2 is vulnerable to Broken Access Control
Software Just Custom Fields Type Plugin Vulnerable versions = 3.3.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46203 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fc45a795b56e Credits Abdi Pranata Required...