11413 matches found
CVE-2023-26217 TIBCO EBX Add-ons SQL Injection Vulnerability
The Data Exchange Add-on component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged user with import permissions and network access to the EBX server to execute arbitrary SQL statements on the affected system. Affected releases a...
CVE-2023-26217 TIBCO EBX Add-ons SQL Injection Vulnerability
The Data Exchange Add-on component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged user with import permissions and network access to the EBX server to execute arbitrary SQL statements on the affected system. Affected releases a...
WordPress WPGutenBlog Demo Import Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)
Software WPGutenBlog Demo Import Type Plugin Vulnerable versions = 1.0.2 Fixed in 1.0.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID e838d8b2eb5f Credits Rafie Muhammad Patchstack...
TIBCO Software EBX Add-ons SQL注入漏洞
TIBCO Software EBX Add-ons is an add-on from TIBCO Software, Inc. that enhances the functionality of the Tibco Ebx data management platform. A security vulnerability exists in TIBCO EBX Add-ons versions 4.5.17 and earlier, 5.6.2 and earlier, and 6.1.0, which stems from an easily exploitable...
WordPress WPEventPartners Demo Import Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)
Software WPEventPartners Demo Import Type Plugin Vulnerable versions = 1.0.3 Fixed in 1.0.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID a8b8e9b1e719 Credits Rafie Muhammad Patchstac...
GHSA-M88M-CRR9-JVQQ OpenRefine vulnerable to zip slip in project import
Impact A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution if a user can be convinced to import it. Patches The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as...
OpenRefine vulnerable to zip slip in project import
Impact A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution if a user can be convinced to import it. Patches The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as...
Improper Authentication
Gitlab is vulnerable to Improper Authentication. The vulnerability allows unauthenticated users to access the import error information if a project was imported from GitHub resulting in information disclosure...
TIBCO Security Advisory: July 18, 2023 - TIBCO EBX Add-ons -CVE-2023-26217
TIBCO EBX Add-ons SQL Injection Vulnerability Original release date: July 18, 2023 Last revised:--- CVE-2023-26217 Source: TIBCO SoftwareInc. Products Affected TIBCO EBX Add-ons versions 4.5.17 and below TIBCO EBX Add-ons versions 5.6.2 and below TIBCO EBX Add-ons version 6.1.0 The following...
CVE-2023-3403
The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pmuploadcsv' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to import...
CVE-2023-3459 Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change
The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hfupdatecustomer' function called via an AJAX action in versions up to, and including, 2.4.1. This makes it possible for authenticated...
WordPress Plugin Export and Import Users and Customers 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
WordPress Import Export WordPress Users Plugin <= 2.4.1 is vulnerable to Broken Access Control
Software Import Export WordPress Users Type Plugin Vulnerable versions = 2.4.1 Fixed in 2.4.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-3459 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID 1ce4b4916f80 Credits Lana Codes...
WordPress WPHobby Demo Import Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)
Software WPHobby Demo Import Type Plugin Vulnerable versions = 1.1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d1dee08a5293 Credits Rafie Muhammad Patchstack...
WordPress Import Social Statistics Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)
Software Import Social Statistics Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 847bf2e0ca26 Credits Rafie Muhammad Patchstack...
PT-2023-24645 · WordPress · Profilegrid
Name of the Vulnerable Software and Affected Versions: ProfileGrid plugin for WordPress versions up to, and including, 5.5.1 Description: The issue allows authenticated attackers with subscriber-level permissions or above to import new users and update existing users due to a missing capability...
PT-2023-5893 · Unknown +2 · Openrefine +2
Name of the Vulnerable Software and Affected Versions: OpenRefine versions prior to 3.7.4 Description: The issue is related to a Zip Slip vulnerability in OpenRefine, which can be exploited by a specially crafted malicious OpenRefine project tar file. This can lead to arbitrary code execution in...
Server Side Request Forgery (SSRF)
Description There is Blind SSRF on the vocabulary screen in the administrator screen. Proof of Concept Step 1. Log in to the administrator screen and access "Import new vocabulary" from the "vocabulary" page. Step 2. Specify the following Payload in the "Vocabulary URL" field and check that the...