CVE-2023-45147 Arbitrary keys can be added to a topic's custom fields by any user in Discourse

Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation...

CVE-2023-36955

TOTOLINK CP300+ =V5.2cu.7594B20200910 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule...

CVE-2023-36947

TOTOLINK X5000R V9.1.0u.6118B20201102 and TOTOLINK A7000R V9.1.0u.6115B20201022 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule...

CVE-2023-36947

TOTOLINK X5000R V9.1.0u.6118B20201102 and TOTOLINK A7000R V9.1.0u.6115B20201022 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule...

TOTOLINK X5000R和TOTOLINK A7000R 缓冲区错误漏洞

TOTOLINK X5000R is a router.TOTOLINK A7000R is a wireless router. A stack overflow vulnerability exists in the TOTOLINK X5000R and A7000R UploadCustomModule function, which can be exploited by an attacker to execute arbitrary code on the system or cause a denial of service...

WordPress Custom post types Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Custom post types Type Plugin Vulnerable versions = 5.0.2 Fixed in 5.0.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32116 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID de51dde21ff9 Credits Taihei Shimamine...

TOTOLINK CP300+ Buffer Error Vulnerability

The TOTOLINK CP300+ is a wireless router from China's Gion Electronics TOTOLINK. A security vulnerability exists in TOTOLINK CP300+ version V5.2cu.7594B20200910 and prior versions, which originates from a stack overflow contained in the File parameter of the function UploadCustomModule...

PT-2023-25749 · Totolink · Totolink X5000R +1

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R version 9.1.0u.6118 B20201102 TOTOLINK A7000R version 9.1.0u.6115 B20201022 Description: A stack overflow issue was discovered via the File parameter in the UploadCustomModule function. This issue affects the specified version...

WordPress The Awesome Feed – Custom Feed Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS)

Software The Awesome Feed – Custom Feed Type Plugin Vulnerable versions = 2.2.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46077 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID bf6946983fa1 Credits Nguy...

PT-2023-29438 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.1 Discourse versions prior to 3.2.0.beta2 Description: Discourse is an open source community platform. In affected versions, any user can create a topic and add arbitrary custom fields to a topic. The severity ...

Discourse Information Disclosure Vulnerability

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. An information disclosure vulnerability exists in Discourse that originates from allowing any user to create a topic and add arbitrary custom fields to the topic...

HBSQLI - Automated Tool For Testing Header Based Blind SQL Injection

HBSQLI is an automated command-line tool for performing Header Based Blind SQL injection attacks on web applications. It automates the process of detecting Header Based Blind SQL injection vulnerabilities, making it easier for security researchers , penetration testers & bug bounty hunters to tes...

Researchers Unveil ToddyCat's New Set of Tools for Data Exfiltration

The advanced persistent threat APT actor known as ToddyCat has been linked to a new set of malicious tools that are designed for data exfiltration, offering a deeper insight into the hacking crew's tactics and capabilities. The findings come from Kaspersky, which first shed light on the adversary...

CVE-2023-44689

e-Gov Client Application Windows version versions prior to 2.1.1.0 and e-Gov Client Application macOS version versions prior to 1.1.1.0 are vulnerable to improper authorization in handler for custom URL scheme. A crafted URL may direct the product to access an arbitrary website. As a result, the...

CVE-2023-44689

e-Gov Client Application Windows version versions prior to 2.1.1.0 and e-Gov Client Application macOS version versions prior to 1.1.1.0 are vulnerable to improper authorization in handler for custom URL scheme. A crafted URL may direct the product to access an arbitrary website. As a result, the...

CVE-2023-44689

CVE-2023-44689 affects e-Gov Client Application: Windows prior to 2.1.1.0 and macOS prior to 1.1.1.0 are vulnerable to improper authorization in the handler for the custom URL scheme. A crafted URL can direct the application to access an arbitrary website, enabling phishing scenarios. Publicly do...

WordPress Get Custom Field Values Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Get Custom Field Values Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-45604 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 8b0df9061359 Credits Satoo Nakano Required privilege...

CVE-2023-41851

Cross-Site Request Forgery CSRF vulnerability in Dotsquares WP Custom Post Template = 1.0 versions...

CVE-2023-41851

Cross-Site Request Forgery CSRF vulnerability in Dotsquares WP Custom Post Template = 1.0 versions...

CVE-2023-41851 WordPress WP Custom Post Template Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Dotsquares WP Custom Post Template = 1.0 versions...