WordPress Ping Optimizer <= 2.35.1.3.0 - Log Clearing via CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as clearing logs. PoC Make a logged in admin open the URL below...

CVE-2024-0858

The Innovs HR WordPress plugin through 1.0.3.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees...

BMC Control-M Security Vulnerability

BMC Control-M is an application from BMC Corporation. Simplifies application and data workflow orchestration locally or as a service. A security vulnerability exists in BMC Control-M branches versions 9.0.20 and 9.0.21, which originates from a vulnerability that allows a logged-in user to...

PT-2024-18165 · Bmc · Bmc Control-M

Name of the Vulnerable Software and Affected Versions: BMC Control-M versions 9.0.20 through 9.0.21 Description: The issue is related to improper authorization in the report management and creation module, allowing logged-in users to read and make unauthorized changes to any reports within the...

Apache DolphinScheduler Security Bypass Vulnerability

Apache Dolphinscheduler is a modern data scheduling platform from the Apache USA Foundation. The Apache DolphinScheduler security bypass vulnerability, which stems from a session not being logged off after a password change, can be exploited by an attacker to bypass access restrictions by sending...

PT-2024-18473 · WordPress · Simple Membership

Name of the Vulnerable Software and Affected Versions: Simple Membership plugin for WordPress versions up to, and including, 4.4.2 Description: The issue is related to Stored Cross-Site Scripting via the Display Name parameter due to insufficient input sanitization and output escaping. This allow...

Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged

In Apache Linkis =1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. We recommend users upgrade the version of Linkis to version 1.5.0...

BIT-ROUNDCUBE-2020-12626

An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered...

Fujifilm DocuPrint Security Vulnerability

Fujifilm DocuPrint is a series of double-sided multifunction photocopiers from Fujifilm, Japan. A security vulnerability exists in Fujifilm DocuPrint that stems from susceptibility to cross-site request forgery attacks, where user information may be altered if a user views a malicious page while...

CVE-2024-25064

Due to insufficient server-side validation, an attacker with login privileges could access certain resources that the attacker should not have access to by changing parameter values...

Cross-Site Scripting

github.com/apache/incubator-answer is vulnerable to Cross-site Scripting XSS. The vulnerability is due to inadequate sanitization of user input in the summary field, which allows a logged-in attacker to inject malicious code when modifying their own submitted question...

CVE-2024-24817

Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discourse. Prior to version 0.4, event invitees created in topics in private categories or PMs private messages can be retrieved by anyone, even if they're not logg...

Unrestricted file upload

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Pixel Flood Attack by uploading large pixel files will cause server out of memory. A logged-in user can cause such an attack by uploading an image when posting content...

Apache DolphinScheduler 安全漏洞

Apache Dolphinscheduler is a modern data scheduling platform from the Apache USA Foundation. The Apache DolphinScheduler security bypass vulnerability, which stems from a session not being logged off after a password change, can be exploited by an attacker to bypass access restrictions by sending...

CVE-2023-6501

The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2023-6499

The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

WordPress Plugin Splashscreen Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

PT-2024-1641 · Splunk · Splunk Add-On Builder

Name of the Vulnerable Software and Affected Versions: Splunk Add-on Builder versions prior to 4.1.4 Description: The issue is related to the application writing user session tokens to its internal log files when visiting the Splunk Add-on Builder or when building or editing a custom app or add-o...

CVE-2023-6633

The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks...

CVE-2023-6633

The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks...