CVE-2021-44948

CVE-2021-44948 is rejected; this candidate is a duplicate of CVE-2021-44942 and not an active vulnerability entry.

Cross-site Request Forgery (CSRF)

ssddanbrown/bookstack is vulnerable to cross-site request forgery attacks. The library does not properly validate the user login flow after the email confirmation, allowing an attacker to duplicate the username and gain access to the account when user click the confirmation link...

CVE-2021-43320

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-41244. Reason: This candidate is a reservation duplicate of CVE-2021-41244. Notes: All CVE users should reference CVE-2021-41244 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2021-43320

CVE-2021-43320 is a reservation duplicate of CVE-2021-41244. Grafana before 8.2.4 with the fine-grained access control feature enabled and multiple organizations allows an Organization Admin to list, add, remove, and update user roles in other organizations where they are not admins. Affected ver...

GitHub Security Lab: ihsinme: CPP Add query for CWE-675 Duplicate Operations on Resource

This bug was reported directly to GitHub Security Lab...

Cross-site Scripting in kimai2

CSRF related to duplicate action. the duplication occurs first before redirecting to edit form. This vulnerability is capable of tricking admin users to duplicate teams...

Cross-Site Request Forgery (CSRF)

kevinpapst/kimai2 is vulnerable to cross-site request forgery. An attacker can add admin users to duplicate teams through the duplicateAction function in ProjectController.php...

Logo Carousel < 3.4.2 - Unauthorised Private Post Access

The plugin allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature PoC 1 Go to Logo Carousel - Shortcode Generator. 2 If there is no carousel, create one. 3 Copy URL of the "Duplicate" link under the...

CVE-2021-43408

The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur when client supplied data is included within an SQL Query insecurely. SQL Injection can typically be exploited to read, modify and delete SQL table data. In...

CVE-2021-43408

The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur when client supplied data is included within an SQL Query insecurely. SQL Injection can typically be exploited to read, modify and delete SQL table data. In...

Sql injection

The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur when client supplied data is included within an SQL Query insecurely. SQL Injection can typically be exploited to read, modify and delete SQL table data. In...

CVE-2021-43408

Summary (CVE-2021-43408) : The WordPress plugin “Duplicate Post” (versions up to 1.1.9) is vulnerable to SQL Injection via an authenticated user with plugin access. The root cause is improper sanitization/escaping of SQL statements when the cdp_action_handling AJAX action processes the id paramet...

CVE-2021-43408 Duplicate Post WordPress Plugin SQL Injection Vulnerability

The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur when client supplied data is included within an SQL Query insecurely. SQL Injection can typically be exploited to read, modify and delete SQL table data. In...

WordPress 插件SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin. The WordPress plugin Duplicate Post version 1.1.9 suffers...

Missing duplicate veto check

Handle defsec Vulnerability details Impact On the GovernorAlpha contract, function veto has been added. Although the function behaviour is expected, duplicate veto process has not been checked on that function. Proof of Concept 1. Navigate to following contract line. function vetouint256...

PT-2021-8167 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a memory leak in the perf env insert btf function when a duplicate BTF id is encountered. This function does not insert the duplicate id and causes a memory lea...

Cross-Site Request Forgery (CSRF) in bookstackapp/bookstack

Description Login CSRF via /register/confirm/token endpoint. Proof of Concept 1: Register account with the same username as our victim, an email confirmation will take place 2: Retrieve token from email. 3: Send a link http://BOOKSTACKAPPURL/register/confirm/token to user. 4: When the user clicks...

CVE-2021-3896

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-43389. Reason: This candidate is a reservation duplicate of CVE-2021-43389. Notes: All CVE users should reference CVE-2021-43389 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

UBUNTU-CVE-2021-3896

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-43389. Reason: This candidate is a reservation duplicate of CVE-2021-43389. Notes: All CVE users should reference CVE-2021-43389 instead of this candidate. All references and descriptions in this candidate have been removed t...

CVE-2021-3896

CVE-2021-43389 is a Linux kernel vulnerability tracked across multiple advisories. Connected documents confirm an array-index-out-of-bounds flaw in the ISDN CAPI in kcapi.c (detach_capi_ctr) within the kernel’s CAPI/ISDN stack, leading to an out-of-bounds read and potential object type confusion....