29036 matches found
Design/Logic Flaw
Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.12...
CVE-2023-1887 Business Logic Errors in thorsten/phpmyfaq
Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12...
CVE-2023-1887
CVE-2023-1887 affects thorsten/phpmyfaq prior to 3.1.12. The vulnerability stems from business logic errors that let users with edit-only permissions add/delete categories and add FAQs. The issue is fixed in version 3.1.12. Affected versions before 3.1.12 should upgrade to 3.1.12 or apply the ven...
CVE-2023-1887 Business Logic Errors in thorsten/phpmyfaq
Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12...
CVE-2023-1887: Undefined Security Weakness
Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12...
CVE-2023-1887 Business Logic Errors in thorsten/phpmyfaq
Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12...
Design/Logic Flaw
Inappropriate implementation in Extensions in Google Chrome prior to 112.0.5615.49 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. Chromium security severity: Medium...
Design/Logic Flaw
Inappropriate implementation in WebShare in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially hide the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Low...
Design/Logic Flaw
Inappropriate implementation in FedCM in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...
Cross site request forgery (csrf)
SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery CSRF protecti...
Design/Logic Flaw
Incorrect security UI in Picture In Picture in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially perform navigation spoofing via a crafted HTML page. Chromium security severity: Medium...
Design/Logic Flaw
Incorrect security UI in Navigation in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform domain spoofing via a crafted HTML page. Chromium security severity: Low...
Design/Logic Flaw
Use after free in Frames in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
Design/Logic Flaw
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the OAuth filter assumes that a state query param is present on any response that looks like an OAuth redirect response. Sending it a request with t...
Design/Logic Flaw
The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could send API requests that the affected devices would execute...
Design/Logic Flaw
An issue found in Wondershare Technology Co.,Ltd Edraw-max v.12.0.4 allows a remote attacker to execute arbitrary commands via the edraw-maxsetupfull5371.exe file...
Design/Logic Flaw
An issue found in Jsish v.3.0.11 and before allows an attacker to cause a denial of service via the StringReplaceCmd function in the src/jsiChar.c file...
Design/Logic Flaw
An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function...