Design/Logic Flaw

An issue was discovered in Nokia NetAct 22 through the Site Configuration Tool website section. A malicious user can change a filename of an uploaded file to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2023-252)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-252 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Dell Wyse Management Suite 安全漏洞

Wyse Management Suite is a scalable solution for managing and optimizing Wyse endpoints from Dell, USA. The product includes centralized management of Wyse endpoints, asset tracking and automated device discovery. A denial of service vulnerability exists in Wyse Management Suite prior to version...

WordPress Mail Bank - #1 Mail SMTP Plugin for WordPress Plugin <= 3.0.12 is vulnerable to Cross Site Scripting (XSS)

Software Mail Bank - 1 Mail SMTP Plugin for WordPress Type Plugin Vulnerable versions = 3.0.12 Fixed in 3.0.13 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 0fd620833027 Credits Rafie...

WordPress WPCasa Mail Alert Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS)

Software WPCasa Mail Alert Type Plugin Vulnerable versions = 3.2.2 Fixed in 3.3.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID d48ff82e255d Credits Rafie Muhammad Patchstack Required...

WordPress WP Mail Log Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Software WP Mail Log Type Plugin Vulnerable versions = 1.0.2 Fixed in 1.1.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 0ce743ed2f3d Credits Rafie Muhammad Patchstack Required...

PT-2023-24620

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in WPVibes WP Mail Log allows DOM-Based XSS. This issue affects WP Mail Log: from n/a through 1.0.2...

WordPress Temp Mail X Theme <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Temp Mail X Type Theme Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 010056c53463 Credits Rafie Muhammad Patchstack Required...

WordPress WP Temp Mail (Temporary Mail Service Powered By WordPress) Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Temp Mail Temporary Mail Service Powered By WordPress Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6a5eb4e385ef...

WordPress Auto Mail - Abandoned Cart Recovery, Newsletter Builder & Marketing Automation for WooCommerce Plugin < 1.1.78 is vulnerable to Cross Site Scripting (XSS)

Software Auto Mail - Abandoned Cart Recovery, Newsletter Builder & Marketing Automation for WooCommerce Type Plugin Vulnerable versions 1.1.78 Fixed in 1.1.78 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1...

WordPress Mail Control Plugin <= 0.2.8 is vulnerable to Cross Site Scripting (XSS)

Software Mail Control Type Plugin Vulnerable versions = 0.2.8 Fixed in 0.3.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 341355a3220a Credits Rafie Muhammad Patchstack Required...

SUSE: Security Advisory (SUSE-SU-2023:2849-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for thunderbird (FEDORA-2023-a93d7639cd)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-7GJ7-224W-VPR3 Spring-boot-admin sandbox bypass via crafted HTML

Thymeleaf through 3.1.1.RELEASE as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 allows for a sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there is write access ...

CVE-2023-37786

Multiple cross-site scripting XSS vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Mail Settingsbackend, Mail Settingshost, Mail Settingsport and Mail Settingsauth parameters of the /admin/configuration.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Mail Settingsbackend, Mail Settingshost, Mail Settingsport and Mail Settingsauth parameters of the /admin/configuration.php...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update ...

SUSE CVE-2022-48521

An issue was discovered in OpenDKIM through 2.10.3, and 2.11.x through 2.11.0-Beta2. It fails to keep track of ordinal numbers when removing fake Authentication-Results header fields, which allows a remote attacker to craft an e-mail message with a fake sender address such that programs that rely...

[SECURITY] Fedora 38 Update: thunderbird-102.13.0-1.fc38

Mozilla Thunderbird is a standalone mail and newsgroup client...

CVE-2023-37786

Multiple cross-site scripting XSS vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Mail Settingsbackend, Mail Settingshost, Mail Settingsport and Mail Settingsauth parameters of the /admin/configuration.php...