8266 matches found
CVE-2023-2812
The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2023-2812
The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Input validation
The QuBot WordPress plugin before 1.1.6 doesn't filter user input on chat, leading to bad code inserted on it be reflected on the user dashboard...
CVE-2023-2812 Ultimate Dashboard < 3.7.6 - Admin+ Stored XSS
The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2023-2812 Ultimate Dashboard < 3.7.6 - Admin+ Stored XSS
The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2023-2399 qubotchat < 1.1.6 - Unauthenticated Stored XSS
The QuBot WordPress plugin before 1.1.6 doesn't filter user input on chat, leading to bad code inserted on it be reflected on the user dashboard...
CVE-2023-2399
The CVE-2023-2399 entry concerns the QuBot WordPress plugin. Affected version: prior to 1.1.6. Root cause: the plugin fails to filter user input in chat, allowing unauthenticated users to inject code that is reflected in the user dashboard (stored XSS). Documented impact: described as Unauthentic...
WordPress plugin qubotchat 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...
WordPress Plugin Ultimate Dashboard 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
PT-2023-19340 · WordPress · Qubot
Name of the Vulnerable Software and Affected Versions: QuBot WordPress plugin versions prior to 1.1.6 Description: The issue concerns the QuBot WordPress plugin, where it fails to filter user input on chat. This allows malicious code to be inserted and reflected on the user dashboard...
CVE-2023-3001
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file...
CVE-2023-3001
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file...
CVE-2023-3001
Schneider Electric IGSS Dashboard (DashBoard.exe) vulnerability CVE-2023-3001: Deserialization of untrusted data (CWE-502) can lead to remote code execution when a user opens a malicious file. Affected: Dashboard v16.0.0.23130 and prior. CVSSv3.1 base score 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:...
CVE-2023-3001
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file...
Schneider Electric IGSS 代码问题漏洞
Schneider Electric IGSS is a multi-player collaborative application from Schneider Electric, France. A code issue vulnerability exists in Schneider Electric IGSS Dashboard DashBoard.exe v16.0.0.23130 and prior versions, which stems from untrustworthy data deserialization in the Dashboard module,...
PT-2023-3139 · Schneider Electric · Igss
Name of the Vulnerable Software and Affected Versions: Schneider Electric IGSS affected versions not specified Description: A Deserialization of Untrusted Data issue exists in the Dashboard module, potentially leading to remote code execution when an attacker gets the user to open a malicious fil...
Security Bulletin: Multiple vulnerabilities in IBM Semeru Runtime affect z/Transaction Processing Facility
Summary There are multiple vulnerabilities in IBM® Semeru Runtime Certified Edition 11 that is used by the z/TPF system. z/TPF has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-21967 DESCRIPTION: An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Editi...
Password Reset Hack Exposed in Honda's E-Commerce Platform, Dealers Data at Risk
Security vulnerabilities discovered in Honda's e-commerce platform could have been exploited to gain unrestricted access to sensitive dealer information. "Broken/missing access controls made it possible to access all data on the platform, even when logged in as a test account," security researche...
