1405 matches found
WordPress plugin Essential Addons for Elementor 授权问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. An authorization issue vulnerabilit...
CVE-2023-32243: Improper Authentication
Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1...
PT-2023-3024
Name of the Vulnerable Software and Affected Versions Essential Addons for Elementor versions 5.4.0 through 5.7.1 Description The issue is related to an Improper Authentication vulnerability in Essential Addons for Elementor, which allows Privilege Escalation. This can be exploited by a remote...
CVE-2022-45818 WordPress Hero Banner Ultimate Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP OnlineSupport, Essential Plugin Hero Banner Ultimate plugin = 1.3.4 versions...
CVE-2022-45818
CVE-2022-45818 is a stored XSS vulnerability in the WordPress plugin Hero Banner Ultimate (
PT-2023-14767
Name of the Vulnerable Software and Affected Versions Essential Plugin Hero Banner Ultimate plugin versions 1.3.4 and earlier Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by authenticated users with contributor or higher...
CVE-2022-45818: Improper Neutralization of Input During Web Page Generation
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP OnlineSupport, Essential Plugin Hero Banner Ultimate plugin = 1.3.4 versions...
CVE-2023-0896
A default password was reported in Lenovo Smart Clock Essential with Alexa Built In that could allow unauthorized device access to an attacker with local network access...
CVE-2023-0896
CVE-2023-0896 : Lenovo Smart Clock Essential with Alexa Built In has a default password that could allow unauthorized access by an attacker on the same local network. The CVE score is 8.8 (HIGH; AV: Adjacent, AC: Low, PR: None, UI: None, S: Unchanged; C/I/A: High). Connected sources describe a ha...
CVE-2023-0896: Improper Input Validation
A default password was reported in Lenovo Smart Clock Essential with Alexa Built In that could allow unauthorized device access to an attacker with local network access...
Essential Blocks < 4.0.7 - Multiple Functions Missing Authorization Checks
The plugin does not apply authorization checks on multiple sensitive functions in the plugin, making them reachable to users with low privileges like Subscribers. Additionally, its nonce validation logic can be bypassed. Affected functions include: save, get, templates, templatecount,...
PT-2023-16599 · Lenovo · Lenovo Smart Clock Essential
Name of the Vulnerable Software and Affected Versions: Lenovo Smart Clock Essential with Alexa Built In affected versions not specified Description: A default password in the device could allow unauthorized access to an attacker with local network access. Recommendations: At the moment, there is ...
Lenovo Group Ltd. Smart Clock Essential SSH hard-coded password vulnerability
Talos Vulnerability Report TALOS-2023-1692 Lenovo Group Ltd. Smart Clock Essential SSH hard-coded password vulnerability April 13, 2023 CVE Number CVE-2023-0896 SUMMARY A hard-coded password vulnerability exists in the SSH, telnet functionality of Lenovo Group Ltd. Smart Clock Essential 4.9.113. ...
CVE-2022-38077
Cross-Site Request Forgery CSRF vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin = 2.2.1 versions...
CVE-2022-38077
Cross-Site Request Forgery CSRF vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin = 2.2.1 versions...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin = 2.2.1 versions...
CVE-2022-38077
CVE-2022-38077 is a CSRF vulnerability affecting the WP OnlineSupport / Popup Anything plugin for WordPress, in versions ≤ 2.2.1. The issue permits unauthorized cross-site requests that can be executed by an attacker due to unauthenticated access requirements. A fix has been released: upgrade to ...
CVE-2022-38077 WordPress Popup Anything Plugin <= 2.2.1 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin = 2.2.1 versions...
CVE-2022-38077: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin = 2.2.1 versions...
