CVE-2023-24060

Haven 5d15944 allows Server-Side Request Forgery SSRF via the feedurl= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname or even the hostname of the Haven server itself. NOTE: this product has significant usage but...

CVE-2023-24060

Haven 5d15944 contains a Server-Side Request Forgery (SSRF) in the feed[url] Feeds functionality. An authenticated user who can create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname (including the Haven server’s own hostname). The vulnerability description does not specify an aff...

CVE-2023-24060

Haven 5d15944 allows Server-Side Request Forgery SSRF via the feedurl= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname or even the hostname of the Haven server itself. NOTE: this product has significant usage but...

CVE-2023-24060: Server-Side Request Forgery (SSRF)

Haven 5d15944 allows Server-Side Request Forgery SSRF via the feedurl= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname or even the hostname of the Haven server itself. NOTE: this product has significant usage but...

PT-2023-19383

Name of the Vulnerable Software and Affected Versions Haven affected versions not specified Description The issue allows Server-Side Request Forgery SSRF via the feedurl Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary...

CVE-2023-22724

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

UBUNTU-CVE-2023-22724

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

CVE-2023-22724 glpi contains XSS in RSS Description Link

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

CVE-2023-22724

GLPI is affected by CVE-2023-22724: versions prior to 10.0.6 are vulnerable to Cross-site Scripting via malicious RSS feeds imported by an administrator. Visiting RSS content with a crafted link can execute JavaScript in a user’s browser. The flaw is mitigated by upgrading to 10.0.6 or newer, per...

CVE-2023-22724: Improper Neutralization of Input During Web Page Generation

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

PT-2023-18666 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.6 Description: The issue concerns cross-site scripting via malicious RSS feeds. An administrator can import a malicious RSS feed containing Cross Site Scripting XSS payloads inside RSS links. When victims visit the...

WordPress Spotlight Social Media Feeds Plugin < 1.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Spotlight Social Media Feeds Type Plugin Vulnerable versions 1.4.3 Fixed in 1.4.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0379 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 727812743302 Credits Lana...

Spotlight Social Feeds < 1.4.3 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC Exploit Additional CSS classes for "Spotlight...

WordPress WP eBay Product Feeds Plugin <= 3.3.1 is vulnerable to Cross Site Scripting (XSS)

Software WP eBay Product Feeds Type Plugin Vulnerable versions = 3.3.1 Fixed in 3.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23722 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 951d668c8f74 Credits yuyudhn Required...

stRSR.seizeRSR() should check whether the basket of collateral is defaulted

Lines of code Vulnerability details Impact Backing Manager can seize RSR anytime and not within reason. RSR stakers will lose their funds. Proof of Concept Protocol states that staked RSR can be seized in the case of a collateral default, in a process that is entirely mechanistic based on on-chai...

CVE-2022-44877

creationtimestamp| type| source ---|---|--- 2023-01-05 19:40:32+00:00| published-proof-of-concept| https://t.me/thebugbountyhunter/6905 2023-01-06 02:19:20+00:00| seen| https://t.me/cibsecurity/56025 2023-01-06 08:11:28+00:00| published-proof-of-concept| https://t.me/proxybar/1261 2023-01-07...

CVE-2018-0147

creationtimestamp| type| source ---|---|--- 2022-12-19 17:20:10+00:00| exploited| https://t.me/truesecator/3847 2022-12-20 16:28:45+00:00| exploited| https://t.me/itsecnews/1954 2022-12-23 11:06:28+00:00| seen| https://t.me/icscert/679 2023-06-14 21:10:03+00:00| seen|...

Lack of validation on price feeds

Lines of code Vulnerability details Impact Lack of validation on Chainlink price feeds may result in incorrectly functioning or non-functioning protocol. For example: during high volatility a price feed may be suspended or become stale; on L2 networks the sequencer might be down on L2 networks th...

Wordfence Launches Free Vulnerability Database For Commercial Use – And Launches Security Portal

Today we are incredibly excited to announce that Wordfence is launching an entirely free vulnerability database API and web interface, available for commercial use by hosting companies, security organizations, threat analysts, security researchers, and the WordPress user community. This is part o...

CVE-2022-42856

creationtimestamp| type| source ---|---|--- 2022-12-13 19:34:15+00:00| exploited| https://t.me/alexmakus/4871 2022-12-14 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=933 2022-12-14 08:28:58+00:00| seen| https://t.me/itsecnews/1920 2022-12-14 15:50:08+00:00| exploited|...