Input validation

Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker with admin or report manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks...

PT-2022-13254 · Nozomi Networks · Nozomi Networks Cmc +1

Name of the Vulnerable Software and Affected Versions: Nozomi Networks Guardian versions prior to 22.0.0 Nozomi Networks CMC versions prior to 22.0.0 Description: The issue is related to improper input validation in the custom report logo upload feature of Nozomi Networks Guardian and CMC. This...

CVE-2022-27246

An issue was discovered in MISP before 2.4.156. An SVG org logo which may contain JavaScript is not forbidden by default...

CVE-2022-27246

An issue was discovered in MISP before 2.4.156. An SVG org logo which may contain JavaScript is not forbidden by default...

CVE-2021-33851

A cross-site scripting XSS attack can cause arbitrary code JavaScript to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Custom logo link" executes whenever the user opens the Settings Page of the "Customize Login Image" Plugin...

CVE-2021-33851

A cross-site scripting XSS attack can cause arbitrary code JavaScript to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Custom logo link" executes whenever the user opens the Settings Page of the "Customize Login Image" Plugin...

CVE-2021-33851

A cross-site scripting XSS attack can cause arbitrary code JavaScript to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Custom logo link" executes whenever the user opens the Settings Page of the "Customize Login Image" Plugin...

JetBrains YouTrack Elevation of Privilege Vulnerability (CNVD-2022-20141)

JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. The software features error tracking, creating workflows and monitoring project progress.An elevation of privilege vulnerability exists in versions prior to JetBrains YouTrack...

CVE-2021-24913

The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswsssaveattachmentdata AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media...

CVE-2021-24913

The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswsssaveattachmentdata AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media...

CVE-2021-24730

The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswsssaveattachmentdata AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media...

CVE-2021-24913 Logo Showcase with Slick Slider < 2.0.1 - Arbitrary Media Title/Description/Alt Text/URL Update via CSRF

The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswsssaveattachmentdata AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media...

CVE-2021-24913

The CVE-2021-24913 entry concerns the WordPress Logo Showcase with Slick Slider plugin vulnerable before 2.0.1. Multiple connected sources confirm a CSRF flaw in the lswss_save_attachment_data AJAX action that allows a logged-in high-privilege user to modify title, description, alt text, and URL ...

CVE-2021-24730 Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update

The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswsssaveattachmentdata AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media...

CVE-2021-24730

CVE-2021-24730 affects the WordPress plugin “Logo Showcase with Slick Slider” prior to version 1.2.5. The issue is an absence of CSRF and authorization checks in the lswss_save_attachment_data AJAX action, allowing any authenticated user (e.g., Subscriber) to modify title, description, alt text, ...

WordPress Logo Showcase with Slick Slider plugin < 2.0.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Logo Showcase with Slick Slider plugin versions 2.0.3. Solution Update the WordPress Logo Showcase with Slick Slider plugin to the latest available version at least 2.0.3...

WordPress SocialMark – Easy Watermark/Logo on Social Media Post Link Share Preview plugin <= 2.0.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress SocialMark – Easy Watermark/Logo on Social Media Post Link Share Preview plugin versions = 2.0.4. Solution Update the WordPress SocialMark – Easy Watermark/Logo on Social Media Post Link Share Preview...

WordPress HM Logo Showcase – Slider & Grid plugin < 1.9 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress HM Logo Showcase – Slider & Grid plugin versions 1.9. Solution Update the WordPress HM Logo Showcase – Slider & Grid plugin to the latest available version at least 1.9...

WordPress HM Logo Showcase – Slider & Grid plugin < 1.9 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress HM Logo Showcase – Slider & Grid plugin versions 1.9. Solution Update the WordPress HM Logo Showcase – Slider & Grid plugin to the latest available version at least 1.9...

WordPress SocialMark – Easy Watermark/Logo on Social Media Post Link Share Preview plugin <= 2.0.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress SocialMark – Easy Watermark/Logo on Social Media Post Link Share Preview plugin versions = 2.0.4. Solution Update the WordPress SocialMark – Easy Watermark/Logo on Social Media Post Link Share Preview plugin to the latest...