1662 matches found
Server-Side Request Forgery (SSRF)
ghost is vulnerable to server-side request forgery SSRF. An attacker with the publisher role editor, author, contributor, administrator in a blog is able to exploit the vulnerability in the embed content module to make arbitrary GET requests in a on behalf of the server, allowing discovery of...
Cross-Site Scripting (XSS)
lazysizes is vulnerable to cross-site scripting XSS. The attributes data-vimeo, data-vimeoparams, data-youtube and data-ytparams are not sanitized by the video-embed plugin, allowing a remote attacker to inject and execute arbitrary Javascript in the user's browser via the affected parameters...
Jetpack 5.1-7.9 - Vulnerability in Shortcode Embed Code
The Jetpack – WP Security, Backup, Speed, & Growth WordPress plugin was affected by a Vulnerability in Shortcode Embed Code security vulnerability...
Advantech WISE-PaaS/RMM WechatSignin wechattokenlogin XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WISE-PasS/RMM. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WechatSignin class. Due to the improper restriction of XML External...
The vulnerability of the pcpu_embed_first_chunk() function in the Linux operating system allows a hacker to gain unauthorized access to certain information.
The vulnerability of the pcpuembedfirstchunk function in the Linux operating system’s kernel relates to the ability to read data from the dmesg output of the printk"pages / cpu" command. Exploiting this vulnerability can allow an intruder to gain unauthorized access to sensitive information...
WordPress embed-comment-images plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. embed-comment-images is a plugin that supports embedding image links in comments. A cross-site scripting vulnerability exists in the...
CVE-2017-18561
The embed-comment-images plugin before 0.6 for WordPress has XSS...
CVE-2017-18561
The CVE-2017-18561 entry concerns the WordPress plugin embed-comment-images with an XSS vulnerability in versions before 0.6. Connected sources consistently describe Cross-Site Scripting in this plugin, evidenced by references noting XSS and a PoC demonstrating an image tag-based vector (e.g., un...
WordPress Real Estate Theme 2.8.9 Cross Site Scripting
Exploit Title: Real Estate 7 - Real Estate WordPress Theme v2.8.9 Persistent XSS Injection Google Dork: inurl:"/wp-content/themes/realestate-7/" Date: 2019/07/20 Author: m0ze Vendor Homepage: https://contempothemes.com Software Link:...
WordPress Theme Real Estate 2.8.9 - Cross-Site Scripting
WordPress Theme Real Estate 2.8.9 - Cross-Site Scripting Exploit Title: Real Estate 7 - Real Estate WordPress Theme v2.8.9 Persistent XSS Injection Google Dork: inurl:"/wp-content/themes/realestate-7/" Date: 2019/07/20 Author: m0ze Vendor Homepage: https://contempothemes.com Software Link:...
CVE-2019-1010091
Removed by vendor...
Khan Academy: RTL override char allowed at khanacademy redirect page
Summary Attacker can embed RTLO character at the following URL https://www.khanacademy.org/computer-programming/linkredirector?url= to trick the user to download suspicious files. Steps to reproduce Visit https://www.khanacademy.org/computer-programming/linkredirector?url= add the following paylo...
Insert or Embed Articulate Content into WordPress plugin <= 4.2998 - Authenticated Remote Code Execution (RCE) vulnerability
Authenticated Remote Code Execution RCE vulnerability found in Insert or Embed Articulate Content into WordPress plugin versions = 4.2998. Solution Update the Insert or Embed Articulate Content into WordPress plugin to the latest available version at least 4.2999...
WordPress plugin Insert or Embed Articulate Content into WordPress remote code execution vulnerability (CNVD-2019-22391)
WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A remote code execution vulnerability exists in the WordPress plugin Insert or Embed...
Fedora 30 : php-twig (2019-874015ee38)
Version 1.38.2 2019-03-12 - added TemplateWrapper::getTemplateName ---- Version 1.38.1 2019-03-12 - fixed class aliases ---- Version 1.38.0 2019-03-12 - fixed sandbox security issue under some circumstances, calling the toString method on an object was possible even if not allowed by the security...
Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core
Withdrawn: Duplicate of GHSA-qcxh-w3j9-58qr...
GHSA-R53M-PFR5-7V87 Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core
Withdrawn: Duplicate of GHSA-qcxh-w3j9-58qr...
CVE-2019-9738
jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...