12563 matches found
CVE-2022-46651: Exposure of Sensitive Information to an Unauthorized Actor
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the...
CVE-2023-23348
HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed...
CVE-2023-23348 HCL Launch is vulnerable to sensitive information disclosure
HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed...
HackerOne: Triager/Team members can edit hacker's report and hacker is not even notified
The hacker's report could be edited by a triager or team member without notifying the hacker, compromising the integrity of the report...
PT-2023-18920 · Hcl · Hcl Launch
Name of the Vulnerable Software and Affected Versions: HCL Launch affected versions not specified Description: The issue concerns the potential disclosure of sensitive information in HCL Launch if a manual edit of a configuration file has been performed. Recommendations: At the moment, there is n...
CVE-2020-36742 Custom Field Template <= 2.5.1 - Cross-Site Request Forgery Bypass
The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on the editmetavalue function. This makes it possible for unauthenticated attackers to edit meta field values vi...
CVE-2021-4384
The WordPress Photo Gallery – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the loadimagesthumbnail and editgallery functions. This makes it possible for unauthenticat...
Cross site request forgery (csrf)
The WordPress Photo Gallery – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the loadimagesthumbnail and editgallery functions. This makes it possible for unauthenticat...
WordPress Plugin Contact Form 7 Style 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
WordPress Plugin Custom Field Template 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site request forgery vulnerability exists in...
Cross site scripting
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights can edit all pages in the CKEditor' space. This makes it possible to perform a variety of harmful actions, such as removing technical documents, leading to loss of...
CVE-2023-3478
A vulnerability classified as critical was found in IBOS OA 4.5.5. Affected by this vulnerability is the function actionEdit of the file ?r=dashboard/roleadmin/edit&op=member of the component Add User Handler. The manipulation of the argument id leads to sql injection. The attack can be launched...
CVE-2023-3473
A vulnerability, which was classified as critical, was found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unknown function of the file /admin/editproduct.php. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The explo...
Campcodes Retro Cellphone Online Store SQL注入漏洞
Campcodes Retro Cellphone Online Store is a retro cellphone online store by Campcodes. Campcodes Retro Cellphone Online Store version 1.0 suffers from a SQL injection vulnerability that originates in the username parameter of the file /admin/editproduct.php that could lead to sql injection...
CVE-2023-36477: Improper Neutralization of Input During Web Page Generation
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights can edit all pages in the CKEditor' space. This makes it possible to perform a variety of harmful actions, such as removing technical documents, leading to loss of...
PT-2023-4820 · Xwiki +1 · Xwiki Platform +1
Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.6 XWiki Platform versions prior to 15.1 XWiki Platform versions older than 14.6RC1 with CKEditor Integration extension prior to 1.64.9 Description: The issue allows any user with edit rights to edit all...
CVE-2023-34934
A stack overflow in the EditBasicSSID5G function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service DoS via a crafted POST request...
CVE-2023-34934
A stack overflow in the EditBasicSSID5G function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service DoS via a crafted POST request...