Debian dla-3678 : horizon-doc - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3678 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3678-1 [email protected] https://www.debian.org/lts/security/...

Denial Of Service (DoS)

apachesuperset is vulnerable to Denial Of Service DoS. The vulnerability is caused by a lack rate limiting in the API and dashboard functionalities. An attacker with authenticated access, could exploit this vulnerability by initiating multiple concurrent requests for dashboard exports. This can...

Apache Superset Allocation of Resources Without Limits or Throttling vulnerability

An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0...

CVE-2023-42504

An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0...

Design/Logic Flaw

An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0...

CVE-2023-42504 Apache Superset: Lack of rate limiting allows for possible denial of service

An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0...

CVE-2023-42504 Apache Superset: Lack of rate limiting allows for possible denial of service

An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0...

PT-2023-28378

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.0 Description The issue allows an authenticated malicious user to initiate multiple concurrent requests, each requesting multiple dashboard exports. This could lead to a possible denial of service...

Virtuozzo Hybrid Infrastructure 6.0 (6.0.0-243)

In this release, Virtuozzo Hybrid Infrastructure provides an upgrade of the Linux distribution, kernel, and toolset packages. This release also contains a range of new features that cover storage performance, object storage, as well as monitoring and alerts. Additionally, this release delivers...

Analytify Dashboard < 5.1.1 - Missing Authorization to Opt-In

Description The Analytify Dashboard plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the optinyes function in versions up to, and including, 5.1.0. This makes it possible for authenticated attackers, with subscriber-level and above acces...

Analytify Dashboard < 5.2.0 - Cross-Site Request Forgery

Description The Analytify – Google Analytics Dashboard For WordPress GA4 analytics made easy plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.1. This is due to missing or incorrect nonce validation on the sendanalyticsemail function. This...

MainWP Dashboard < 4.5.1.3 - Authenticated(Administrator+) CSS Injection

Description The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitization. This makes it possible for authenticated...

CVE-2023-6164

The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitization. This makes it possible for authenticated attackers, wit...

CVE-2023-6164

The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitization. This makes it possible for authenticated attackers, wit...

CVE-2023-4726

The Ultimate Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.7.7. due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions...

CVE-2023-4726

The Ultimate Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.7.7. due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions...

Cross site scripting

The Ultimate Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.7.7. due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions...

Input validation

The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitization. This makes it possible for authenticated attackers, wit...

CVE-2023-4726

The CVE-2023-4726 entry describes a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Ultimate Dashboard, affecting versions up to 3.7.7. The issue arises from insufficient input sanitization and output escaping in admin settings, allowing authenticated administrators (and a...

CVE-2023-6164

The CVE-2023-6164 entry concerns the MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress. It is vulnerable to CSS Injection via the newColor parameter due to insufficient input sanitization in all versions up to and including 4.5.1.2 . The issue affects aut...