CVE-2023-44238

Cross-Site Request Forgery CSRF vulnerability in Joakim Ling Remove slug from custom post type plugin = 1.0.3 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Joakim Ling Remove slug from custom post type plugin = 1.0.3 versions...

CVE-2023-44238

CVE-2023-44238 affects the WordPress plugin Remove slug from custom post type (versions ≤ 1.0.3). The vulnerability is Cross-Site Request Forgery (CSRF) with unauthenticated exploit potential per Patchstack entry; multiple sources corroborate CSRF impact for this plugin. Impact is described as CS...

Popup box < 3.7.2 - Admin+ Stored Cross-Site Scripting

Description The plugin does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfilteredhtml capability is disallowed for example in a multisite setup. 1. Create a new PopUp Box within the plugi...

WordPress Plugin remove-slug-from-custom-post-type Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin...

PortlandLabs Concrete CMS Custom Label Fields Cross-Site Scripting Vulnerability

PortlandLabs Concrete CMS is a team-oriented open source content management system of the United States PortlandLabs company . A cross-site scripting vulnerability exists in the PortlandLabs Concrete CMS Custom Label field. The vulnerability stems from the lack of effective filtering and escaping...

Curl Installed (Linux / Unix)

Binary data curlnixinstalled.nbin...

CVE-2023-44238: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Joakim Ling Remove slug from custom post type plugin = 1.0.3 versions...

Design/Logic Flaw

The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the prflxtrfldsexportfile function in versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to expose potentially...

CVE-2023-4469 Profile Extra Fields by BestWebSoft <= 1.2.7 - Missing Authorization to Sensitive Information Exposure

The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the prflxtrfldsexportfile function in versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to expose potentially...

e-Gov Client Application fails to restrict custom URL schemes properly

Overview e-Gov Client Application is installed, a Custom URL Scheme is configured on the system to enable invoking the product through a web browser. This custom URL contains the information about the website which the product should access, and a crafted URL may direct the application to access ...

PT-2023-29284 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS version 9.2.1 Description: The issue concerns multiple Cross Site Scripting XSS vulnerabilities that allow an attacker to execute arbitrary code via a crafted script. This can be done by exploiting the Header and Footer Tracking...

Digital Agency e-Gov Electronic application Security Breach

The Digital Agency e-Gov Electronic application is an official Japanese government portal from Digital Agency Japan. A security vulnerability exists in Digital Agency e-Gov Electronic application, which stems from an inability to properly restrict custom URL schemes. Affected products and version...

PortlandLabs Concrete CMS 跨站脚本漏洞

PortlandLabs Concrete CMS is a team-oriented open source content management system of the United States PortlandLabs company . A cross-site scripting vulnerability exists in the PortlandLabs Concrete CMS Custom Label field. The vulnerability stems from the lack of effective filtering and escaping...

What’s New in Rapid7 Detection & Response: Q3 2023 in Review

This post takes a look at some of the investments we've made throughout Q3 2023 to our Detection and Response offerings to provide advanced DFIR capabilities with Velociraptor, more flexibility with custom detection rules, enhancements to our dashboard and log search features, and more. Stop...

CVE-2022-3248

A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied...

Design/Logic Flaw

A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied...

CVE-2022-3248 Openshift api admission checks does not enforce "custom-host" permissions

A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied...

CVE-2022-3248 Openshift api admission checks does not enforce "custom-host" permissions

A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied...

PT-2023-13073 · Red Hat · Openshift Ai

Name of the Vulnerable Software and Affected Versions: OpenShift API affected versions not specified Description: A flaw was found in OpenShift API, as admission checks do not enforce custom-host permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be...