15033 matches found
CVE-2022-26593
Cross-site scripting XSS vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of a asset category...
Liferay Portal和Liferay DXP 跨站脚本漏洞
Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB and JMS, and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a...
Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches拒绝服务漏洞
Cisco Catalyst Digital Building Series Switches is a series of digital building switches from Cisco, U.S. Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches have a denial of service vulnerability that can be exploited by an attacker to cause a permanent denial of...
CVE-2022-0706
The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed...
CVE-2022-0707
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack...
CVE-2022-0707
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack...
CVE-2022-0707
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack...
Cross site request forgery (csrf)
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack...
CVE-2022-0707 Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack...
CVE-2022-0707
The CVE concerns the Easy Digital Downloads WordPress plugin, specifically versions before 2.11.6. It states that there is no CSRF check when inserting payment notes, enabling a logged-in administrator to insert arbitrary notes via CSRF. The Red Hat/CNVD records confirm this as a cross-site reque...
CVE-2022-0706 Easy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site Scripting
The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed...
CVE-2022-0706
The CVE-2022-0706 entry concerns the WordPress plugin Easy Digital Downloads (EDD) before version 2.11.6. Affected component: the Downloadable File Name handling in Logs. Root cause: insufficient sanitisation and escaping of the downloadable file name, which could allow stored Cross-Site Scriptin...
CVE-2022-0707: Cross-Site Request Forgery (CSRF)
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack...
WordPress plugin Easy Digital Downloads 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Easy Digital Downloads plugin is vulnerable to a cross-site scripting vulnerability that stems from...
PT-2022-13377
Name of the Vulnerable Software and Affected Versions Easy Digital Downloads versions prior to 2.11.6 Description The issue concerns a lack of CSRF check when inserting payment notes, potentially allowing attackers to make a logged admin insert arbitrary notes via a CSRF attack. Recommendations F...
PT-2022-13376
Name of the Vulnerable Software and Affected Versions Easy Digital Downloads WordPress plugin versions prior to 2.11.6 Description The issue concerns the lack of sanitization and escaping of the Downloadable File Name in the Logs, potentially allowing high-privilege users to perform Cross-Site...
CVE-2022-0706: Improper Neutralization of Input During Web Page Generation
The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed...
WordPress和WordPress plugin 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Easy Digital Downloads plugin is vulnerable to cross-site request forgery, which originates from Ea...