530 matches found
WordPress Favicon Rotator Plugin <= 1.2.10 is vulnerable to Cross Site Scripting (XSS)
Software Favicon Rotator Type Plugin Vulnerable versions = 1.2.10 Fixed in 1.2.11 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-28001 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e90080f8961c Credits Rafie Muhammad Patchstack...
JetBrains TeamCity 2023.05.3 - Remote Code Execution Exploit
Exploit Title: JetBrains TeamCity 2023.05.3 - Remote Code Execution RCE - Shodan Dork: http.title:TeamCity , http.favicon.hash:-1944119648 - Exploit Author: ByteHunter - Vendor: JetBrains - Email: email protected - vendor: JetBrains - Version: versions before 2023.05.4 - Tested on: 2023.05.3 -...
CVE-2023-24416
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Arne Franken All In One Favicon.This issue affects All In One Favicon: from n/a through 4.7...
CVE-2023-24416
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Arne Franken All In One Favicon.This issue affects All In One Favicon: from n/a through 4.7...
CVE-2023-24416
CVE-2023-24416 affects WordPress plugin All In One Favicon (versions
CVE-2023-24416 WordPress All In One Favicon Plugin <= 4.7 is vulnerable to Arbitrary File Deletion
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Arne Franken All In One Favicon.This issue affects All In One Favicon: from n/a through 4.7...
CVE-2023-24416 WordPress All In One Favicon Plugin <= 4.7 is vulnerable to Arbitrary File Deletion
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Arne Franken All In One Favicon.This issue affects All In One Favicon: from n/a through 4.7...
PT-2024-12035 · Unknown · All In One Favicon
Name of the Vulnerable Software and Affected Versions: All In One Favicon versions through 4.7 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This allows an attacker to access files or directories...
WordPress Plugin All In One Favicon Path Traversal Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A path traversal vulnerability exists in...
Server side request forgery (ssrf)
Appwrite = v1.4.13 is affected by a Server-Side Request Forgery SSRF via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159...
Appwrite Code Issue Vulnerability
Appwrite is Appwrite open source an end-to-end backend server . It is used to package web, mobile, native or backend applications as a set of Docker microservices. A security vulnerability exists in Appwrite v1.4.13 and earlier versions, which stems from a discovery via the /v1/avatars/favicon...
VulnCheck KEV: CVE-2023-27159
Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...
CVE-2023-47120
Discourse is an open source platform for community discussion. In versions 3.1.0 through 3.1.2 of the stable branch and versions 3.1.0,beta6 through 3.2.0.beta2 of the beta and tests-passed branches, Redis memory can be depleted by crafting a site with an abnormally long favicon URL and drafting...
Design/Logic Flaw
Discourse is an open source platform for community discussion. In versions 3.1.0 through 3.1.2 of the stable branch and versions 3.1.0,beta6 through 3.2.0.beta2 of the beta and tests-passed branches, Redis memory can be depleted by crafting a site with an abnormally long favicon URL and drafting...
CVE-2023-47120 Discourse DoS through Onebox favicon URL
Discourse is an open source platform for community discussion. In versions 3.1.0 through 3.1.2 of the stable branch and versions 3.1.0,beta6 through 3.2.0.beta2 of the beta and tests-passed branches, Redis memory can be depleted by crafting a site with an abnormally long favicon URL and drafting...
CVE-2023-47120 Discourse DoS through Onebox favicon URL
Discourse is an open source platform for community discussion. In versions 3.1.0 through 3.1.2 of the stable branch and versions 3.1.0,beta6 through 3.2.0.beta2 of the beta and tests-passed branches, Redis memory can be depleted by crafting a site with an abnormally long favicon URL and drafting...
PT-2023-30324 · Discourse +1 · Discourse +1
Name of the Vulnerable Software and Affected Versions: Discourse versions 3.1.0 through 3.1.2 Discourse versions 3.1.0,beta6 through 3.2.0.beta2 Description: Discourse is an open source platform for community discussion. In the affected versions, Redis memory can be depleted by crafting a site wi...
The vulnerability of the /v1/avatars/favicon component of the backend platform for developing mobile and web applications allows a attacker to perform an SSRF attack.
The vulnerability of the /v1/avatars/favicon component in the backend platform for developing mobile and web applications relates to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack using a specially crafted GET request...