14246 matches found
CVE-2024-30426 WordPress Hash Elements plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HashThemes Hash Elements allows Stored XSS.This issue affects Hash Elements: from n/a through 1.3.3...
CVE-2024-30426 WordPress Hash Elements plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HashThemes Hash Elements allows Stored XSS.This issue affects Hash Elements: from n/a through 1.3.3...
WordPress Plugin Hash Elements 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...
PT-2024-23353 · Unknown · Hash Elements
Name of the Vulnerable Software and Affected Versions: Hash Elements versions 1.3.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject malicious...
GHSA-R75M-26CQ-MJXC Serverpod improved security for stored password hashes
Description Improved security for stored password hashes Serverpod now uses the OWASP, source, recommended Argon2Id password hash algorithm to store password hashes for the email authentication module. Starting from Serverpod 1.2.6 all users that either creates an account or authenticates with th...
CVE-2024-27775
SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery SSRF may allow exposing the local OS user's NTLMv2 hash...
CVE-2024-27775 SysAid - CWE-918: Server-Side Request Forgery (SSRF)
SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery SSRF may allow exposing the local OS user's NTLMv2 hash...
CVE-2024-27775 SysAid - CWE-918: Server-Side Request Forgery (SSRF)
SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery SSRF may allow exposing the local OS user's NTLMv2 hash...
CVE-2024-27775
CVE-2024-27775 affects SysAid prior to version 23.2.14 b18. The vulnerability is a Server-Side Request Forgery (SSRF) issue that may expose the local operating system user’s NTLMv2 hash. The PT-security and other sources specify that versions before 23.2.14 b18 are impacted; remediation is to upg...
WordPress Hash Elements Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)
Software Hash Elements Type Plugin Vulnerable versions = 1.3.3 Fixed in 1.3.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30426 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8e463e127c50 Credits Khalid Yusuf Required privilege...
PT-2024-22030 · Sysaid · Sysaid
Name of the Vulnerable Software and Affected Versions: SysAid versions prior to 23.2.14 b18 Description: The issue allows for Server-Side Request Forgery SSRF, which may expose the local OS user's NTLMv2 hash. Recommendations: For versions prior to 23.2.14 b18, update to version 23.2.14 b18 or...
Sysaid Technologies SysAid 代码问题漏洞
Sysaid Technologies SysAid is a suite of IT service management solutions from Sysaid Technologies, Israel. A code issue vulnerability exists in Sysaid Technologies SysAid versions prior to 23.2.14 b18, which stems from the presence of server-side request forgery SSRF, which could allow exposing t...
CVE-2024-29886
Serverpod is an app and web server, built for the Flutter and Dart ecosystem. An issue was identified with the old password hash algorithm that made it susceptible to rainbow attacks if the database was compromised. This vulnerability is fixed by 1.2.6...
CVE-2024-29886 Improved security for stored password hashes
Serverpod is an app and web server, built for the Flutter and Dart ecosystem. An issue was identified with the old password hash algorithm that made it susceptible to rainbow attacks if the database was compromised. This vulnerability is fixed by 1.2.6...
CVE-2024-29886
CVE-2024-29886 affects Serverpod; root cause is an outdated password hash algorithm vulnerable to rainbow attacks if the database is compromised. The issue is mitigated by upgrading to Serverpod 1.2.6, which switches to the Argon2id password hash algorithm for the email authentication module. Not...
GHSA-HM8R-95G3-5HJ9 phpMyFAQ Stored Cross-site Scripting at File Attachments
Summary An attacker with admin privileges can upload an attachment containing JS code without extension and the application will render it as HTML which allows for XSS attacks. Details When attachments are uploaded without an extension, the application renders it as HTML by default. Therefore...
phpMyFAQ Stored Cross-site Scripting at File Attachments
Summary An attacker with admin privileges can upload an attachment containing JS code without extension and the application will render it as HTML which allows for XSS attacks. Details When attachments are uploaded without an extension, the application renders it as HTML by default. Therefore...
CVE-2023-45824
The CVE-2023-45824 issue affects OroPlatform (PHP BAP). A logged-in user can access page state data of pinned pages belonging to other users by using a pageId hash. Publicly documented details indicate this affects OroPlatform versions across multiple lines: 4.2.0–4.2.10, 5.0.0–5.0.12, and 5.1.0–...
PT-2024-13289 · Unknown · Oroplatform
Name of the Vulnerable Software and Affected Versions: OroPlatform versions prior to 5.1.4 Description: A logged in user can access page state data of pinned pages of other users by pageId hash. This issue allows unauthorized access to sensitive information. Recommendations: For versions prior to...
