CVE-2022-25847

CVE-2022-25847 affects the serve-lite package. The root cause is that when a request targets a directory, the server renders a file listing with links that include actual file names without sanitization or output encoding, enabling Cross-site Scripting (XSS) via crafted filenames. Affected: all v...

CVE-2022-25847

All versions of the package serve-lite are vulnerable to Cross-site Scripting XSS because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or output encoding...

CVE-2022-25847

All versions of the package serve-lite are vulnerable to Cross-site Scripting XSS because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or output encoding...

PT-2023-12665 · Unknown · Serve-Lite

Name of the Vulnerable Software and Affected Versions: serve-lite versions all Description: The issue arises from missing input sanitization or other checks and protections employed to the req.url passed as-is to path.join, leading to Directory Traversal. This allows potential access to sensitive...

PT-2023-12821 · Unknown · Serve-Lite

Name of the Vulnerable Software and Affected Versions: serve-lite versions all Description: The issue arises when the software detects a request to a directory and renders a file listing of its contents. This listing includes links with actual file names, but these names are not sanitized or outp...

CVE-2023-0448

The CVE-2023-0448 entry concerns the WordPress WP Helper Lite plugin, affected versions prior to 4.3. The issue arises because the plugin returns all GET parameters unsanitized in responses, enabling a reflected cross-site scripting (XSS) vulnerability. Practical impact described across sources i...

CVE-2023-0448

The WP Helper Lite WordPress plugin, in versions 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability...

CVE-2022-3085

Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to execute arbitrary code...

CVE-2022-3085

Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to execute arbitrary code...

Stack overflow

Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to execute arbitrary code...

WordPress Nice PayPal Button Lite Plugin <= 1.3.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Nice PayPal Button Lite Type Plugin Vulnerable versions = 1.3.5 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-22686 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 497c643d4eec Credits Mika Required...

Nice PayPal Button Lite <= 1.3.5 - CSRF

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

VulnCheck KEV: CVE-2021-24258

The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method...

CVE-2022-3085

Fuji Electric Tellus Lite V-Simulator (versions 4.0.12.0 and prior) is affected by CVE-2022-3085: a stack-based buffer overflow in the software that may allow an attacker to execute arbitrary code. The vulnerability is locally exploitable (attack vector: local; user interaction required) with a C...

CVE-2022-3085

Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to execute arbitrary code...

CVE-2023-22280

MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allow a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command...

CVE-2022-3087

Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to an out-of-bounds write which may allow an attacker to execute arbitrary code...

CVE-2022-3087

Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to an out-of-bounds write which may allow an attacker to execute arbitrary code...

Out-of-bounds

Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to an out-of-bounds write which may allow an attacker to execute arbitrary code...

PT-2023-18394 · Maho Pbx · Maho-Pbx Netdevancer Vsg Lite/Uni +2

Name of the Vulnerable Software and Affected Versions: MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud versions prior to 1.11.00 MAHO-PBX NetDevancer VSG Lite/Uni versions prior to 1.11.00 MAHO-PBX NetDevancer MobileGate Home/Office versions prior to 1.11.00 Description: The issue allows a remote...