CVE-2018-7646

The connected Veracode entry identifies a denial of service in svgexport caused by a missing timeout when loading an external image. Impact is DoS; no exploit details are provided in the supplied documents. No CVE-specific remediation is stated here; monitor for updates.

CVE-2018-19454

The connected document identifies a concrete vulnerability in yiisoft/yii2: information disclosure caused by credentials (e.g., HTTP auth username/password) being logged in the application’s logging target (\yii\log\Target). An attacker who can access the log files could retrieve these credential...

CVE-2018-8085

Veracode entry VERACODE:13415 documents a SAML Signature Relocation vulnerability affecting passport-wsfed-saml2. The issue arises because the validation function does not ensure the Signature element is located correctly within an Assertion, enabling signature relocation attacks. The provided ma...

CVE-2018-14578

The connected Veracode entry identifies a concrete vulnerability in yiisoft/yii2: CSRF due to unvalidated request methods in yii\web\Request::getMethod(), allowing an attacker to bypass CSRF token checks by downgrading the HTTP method to read methods such as GET, HEAD or OPTIONS.

CVE-2018-8548

The connected VERACODE entry (VERACODE:8014) describes a Remote Code Execution vulnerability in microsoft.chakracore, caused by how the scripting engine renders objects in memory, allowing arbitrary code execution in the context of the authenticated user. The CVE mapping to CVE-2018-8548 is not p...

WHO 安全漏洞

WHO is an online video community application. A security vulnerability exists in WHO versions 1.0.28, 1.0.30, and 1.0.32, which originates from a vulnerability that could allow an attacker to elevate privileges via the TTMultiProvider component...

campbeyonkey.org Cross Site Scripting vulnerability OBB-3252298

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-24387

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPdevart Organization chart plugin = 1.4.4 versions...

CVE-2023-24387 WordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPdevart Organization chart plugin = 1.4.4 versions...

CVE-2023-24387 WordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPdevart Organization chart plugin = 1.4.4 versions...

CVE-2023-24387

WPdevart Organization chart plugin for WordPress is affected in versions

WordPress Plugin Organization chart 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-19548 · Wpdevart · Wpdevart Organization Chart Plugin

Name of the Vulnerable Software and Affected Versions: WPdevart Organization chart plugin versions prior to 1.4.5 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with admin+ authentication. This type of vulnerability allows an attacker to...

xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability

A vulnerability was found in X.Org Server. This flaw occurs if a client explicitly destroys the compositor overlay window aka COW, where Xserver leaves a dangling pointer to that window in the CompScreen structure, which will later trigger a use-after-free issue. The Overlay Window use-after-free...

Unpacking the Structure of Modern Cybercrime Organizations

We examine three differently sized criminal groups to know how they compare to similarly sized legitimate businesses in terms of how they are organized. We also discuss how threat researchers can use their knowledge of the size and structure of a target criminal organization to aid their...

CVE-2023-29034

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none...

3 Shifts in the Cyber Threat Landscape

The threat landscape is always changing and these three major shifts are already underway. Learn to recognize them to protect your organization from cyber threats...

CVE-2023-28640 Permissions bypass in Apiman could enable authenticated attacker to unpermitted API Key

Apiman is a flexible and open source API Management platform. Due to a missing permissions check, an attacker with an authenticated Apiman Manager account may be able to gain access to API keys they do not have permission for if they correctly guess the URL, which includes Organisation ID, Client...

IDOR Vulnerability Allow the owner of one Organization can create, edit, delete apikeys that belong to other organization

1 first, we create two organizations: org1 and org2. The owner of them is user1 and user2 corresponding. 2 we login as user1 and create a new API keys 3 using the burpsuit to hack hijack the post. 4 The post and can be like:...

IDOR Vulnerability Allow the owner of one Organization can disable users that belong to other oggainzation

1 first, we create two organizations: org1 and org2. The owner of them is user1 and user2 corresponding. 2 we login as user1 and click disable , then we use burpsuit to get the post. 3 The post can be like : POST /admin/api/users/2/enable/false HTTP/1.1 5 we replace user id 2 to 3. 6 check the...