490 matches found
CVE-2023-5110
The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bsk-pdfm-category-dropdown' shortcode in versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
WordPress Plugin BSK PDF Manager Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plug-in. WordPress Plugin BSK PDF Manager...
CVE-2023-5110: Improper Neutralization of Input During Web Page Generation
The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bsk-pdfm-category-dropdown' shortcode in versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2023-41163
A Reflected Cross-site scripting XSS vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the replace in results field while replacing the results under the tools drop down...
PT-2023-27839 · Usermin · Usermin
Name of the Vulnerable Software and Affected Versions: Usermin version 2.000 Description: A Reflected Cross-site scripting XSS issue in the file manager tab allows remote attackers to inject arbitrary web script or HTML via the replace in results field while replacing the results under the tools...
Cross Site Scripting (XSS)
svelecte is vulnerable to Cross Site Scripting XSS. The vulnerability occurs when a user enters a specially crafted item name in the Svelte dropdown. Sites using Svelecte with dynamically created items from external or user-created content may be vulnerable to XSS attacks and clickjacking...
Svelecte Cross-Site Scripting Vulnerability
Svelecte is a flexible autocomplete/select component written in Svelte. A cross-site scripting vulnerability exists in Svelecte 3.16.2 and earlier versions, which stems from the presence of a cross-site scripting XSS vulnerability. An attacker can exploit this vulnerability to inject arbitrary HT...
CVE-2023-30963 Stored XSS in Foundry Slate Query Dropdown menu
A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.229.0. The service was rolled out to all affected Foundry instances. No further...
CVE-2023-30963 Stored XSS in Foundry Slate Query Dropdown menu
A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.229.0. The service was rolled out to all affected Foundry instances. No further...
Chamilo cross-site scripting vulnerability
Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, distance training, and online question and answer sessions. A security vulnerability exists in Chamilo versions prior to 1.11.20 that...
TinyMCE Custom Styles < 1.1.4 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Go to "Settings" » "TinyMCE Custom Styles"...
CVE-2023-2557
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level...
Malicious code in fc-dropdown (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a99503aba932a84132975cce8dc2b3070cc1df0b8a2d0843ff7c338bad3977c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-343 Malicious code in fc-dropdown (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a99503aba932a84132975cce8dc2b3070cc1df0b8a2d0843ff7c338bad3977c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
com.cisco.step.jenkins.plugins:jenkow-parent (0.1), org.jenkins-ci.main:jenkins-test-harness (1.455) +9 more potentially affected by CVE-2023-27903 via org.jenkins-ci.main:jenkins-core (1.455)
org.jenkins-ci.main:jenkins-core MAVEN version 1.455 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cisco.step.jenkins.plugins:jenkow-parent 0.1 - org.jenkins-ci.main:jenkins-test-harness 1.4...
com.cisco.step.jenkins.plugins:jenkow-parent (0.1), org.jenkins-ci.main:jenkins-test-harness (1.455) +9 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.455)
org.jenkins-ci.main:jenkins-core MAVEN version 1.455 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cisco.step.jenkins.plugins:jenkow-parent 0.1 - org.jenkins-ci.main:jenkins-test-harness 1.4...
com.nirima.jenkins.repository:jenkins-maven-plugin (1.2), com.nirima.jenkins.repository:pom (1.2) +7 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.546)
org.jenkins-ci.main:jenkins-core MAVEN version 1.546 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.nirima.jenkins.repository:jenkins-maven-plugin 1.2 - com.nirima.jenkins.repository:pom 1.2 ...
com.nirima.jenkins.repository:jenkins-maven-plugin (1.2), com.nirima.jenkins.repository:pom (1.2) +7 more potentially affected by CVE-2023-27898 via org.jenkins-ci.main:jenkins-core (1.546)
org.jenkins-ci.main:jenkins-core MAVEN version 1.546 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.nirima.jenkins.repository:jenkins-maven-plugin 1.2 - com.nirima.jenkins.repository:pom 1.2 ...
