CVE-2024-22290

CVE-2024-22290 (WordPress Custom Dashboard Widgets) The vulnerability affects the Custom Dashboard Widgets plugin for WordPress, versions up to and including 1.3.1. It is described as a Cross-Site Request Forgery (CSRF) vulnerability that can lead to Cross-Site Scripting (XSS) via cdw_DashboardWi...

CVE-2024-22290: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in AboZain,O7abeeb,UnitOne Custom Dashboard Widgets allows Cross-Site Scripting XSS.This issue affects Custom Dashboard Widgets: from n/a through 1.3.1...

WordPress plugin Custom Dashboard Widgets Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2024-19311 · Unitone · Unitone Custom Dashboard Widgets

Name of the Vulnerable Software and Affected Versions: AboZain, O7abeeb, UnitOne Custom Dashboard Widgets versions 1.3.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross-Site Scripting XSS in Custom Dashboard Widgets. Recommendations: For...

Grafana XSS via adding a link in General feature

Grafana 5.3.1 has XSS via a link on the "Dashboard All Panels General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099...

GHSA-CMQ2-J8V8-2Q44 Grafana XSS in Dashboard Text Panel

Grafana 5.3.1 has XSS via the "Dashboard Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099...

Grafana XSS in Dashboard Text Panel

Grafana 5.3.1 has XSS via the "Dashboard Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099...

CVE-2023-51843

react-dashboard 1.4.0 is vulnerable to Cross Site Scripting XSS as httpOnly is not set...

CVE-2023-51843

react-dashboard 1.4.0 is vulnerable to Cross Site Scripting XSS as httpOnly is not set...

PT-2024-14314

Name of the Vulnerable Software and Affected Versions react-dashboard version 1.4.0 Description The issue is related to Cross Site Scripting XSS due to the httpOnly flag not being set. This allows an attacker to potentially inject malicious scripts into a user's session. Recommendations For...

React Dashboard Security Vulnerability

React Dashboard is a template. A security vulnerability exists in React Dashboard version 1.4.0, which stems from unset httpOnly and is vulnerable to cross-site scripting attacks...

CVE-2023-51843

react-dashboard 1.4.0 is vulnerable to Cross Site Scripting XSS as httpOnly is not set...

CVE-2023-51843

Summary: CVE-2023-51843 affects the React Dashboard package. Vulnerability: Cross Site Scripting (XSS) arising because the httpOnly flag is not set on cookies. Affected software: react-dashboard 1.4.0. Root cause (as stated): httpOnly is not set, enabling potential exposure of cookie data. Impact...

CVE-2023-51843: Improper Neutralization of Input During Web Page Generation

react-dashboard 1.4.0 is vulnerable to Cross Site Scripting XSS as httpOnly is not set...

WordPress WP Dashboard Notes Plugin < 1.0.11 is vulnerable to Broken Access Control

Software WP Dashboard Notes Type Plugin Vulnerable versions 1.0.11 Fixed in 1.0.11 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-7239 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 48978b33e0d8 Credits Pedro Cuco Illex Required...

coreActivity < 1.8.1 - Unauthenticated Stored XSS

Description The plugin does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin As unauthenticated: curl 'https://example.com/alertXSS' The XSS will be triggered when an...

coreActivity < 1.8.1 - Unauthenticated Stored XSS

Description The plugin does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin PoC As unauthenticated: curl 'https://example.com/' The XSS will be triggered when an adm...

wp-dashboard-notes < 1.0.11 - Contributor+ Arbitrary Private Notes Update via IDOR

Description The plugin does not validate that the user has access to the postid parameter in its wpdnupdatenote AJAX action. This allows users with a role of contributor and above to update notes created by other users. 1. Create a note as an admin. View the source of the page to get the Note ID...

Qualys WAS Unveils New Features in an Upgraded User Interface

Qualys Web Application Scanning WAS has been at the forefront of web application and API security innovation, and today, were excited to announce a significant leap - the launch of our New User Interface UI. From improved performance and reliability to cutting-edge technology adoption and enhance...

PT-2024-1870 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.4 through 16.7.5 GitLab EE versions 16.8 through 16.8.2 GitLab EE versions 16.9 through 16.9.0 Description: An issue has been discovered in GitLab EE, where users with the Guest role can change Custom dashboard projects...