Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF in MiKa's OSM – OpenStreetMap plugin = 6.0.1 versions...

CVE-2022-30544 WordPress OSM – OpenStreetMap Plugin <= 6.0.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in MiKa's OSM – OpenStreetMap plugin = 6.0.1 versions...

CVE-2022-30544

The CVE-2022-30544 entry concerns the WordPress OSM – OpenStreetMap plugin (MiKa’s OSM) up to version 6.0.1, with a Cross-Site Request Forgery (CSRF) vulnerability. The connected sources consistently describe CSRF on the plugin, caused by insufficient CSRF checks in multiple areas, allowing an at...

PT-2023-13013 · Unknown · Mika'S Osm – Openstreetmap Plugin

Name of the Vulnerable Software and Affected Versions: MiKa's OSM – OpenStreetMap plugin versions = 6.0.1 Description: The issue is related to Cross-Site Request Forgery CSRF in the plugin. This means an attacker could potentially trick a user into performing unintended actions on the application...

CVE-2018-25064

A vulnerability was found in OSM Lab show-me-the-way. It has been rated as problematic. This issue affects some unknown processing of the file js/site.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. The patch is named...

CVE-2018-25064

A vulnerability was found in OSM Lab show-me-the-way. It has been rated as problematic. This issue affects some unknown processing of the file js/site.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. The patch is named...

Cross site scripting

A vulnerability was found in OSM Lab show-me-the-way. It has been rated as problematic. This issue affects some unknown processing of the file js/site.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. The patch is named...

CVE-2018-25064 OSM Lab show-me-the-way site.js cross site scripting

A vulnerability was found in OSM Lab show-me-the-way. It has been rated as problematic. This issue affects some unknown processing of the file js/site.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. The patch is named...

CVE-2018-25064

CVE-2018-25064 concerns OSM Lab show-me-the-way . The vulnerability stems from how the file js/site.js is processed, enabling cross-site scripting (XSS) . The issue can be exploited remotely. A patch is referenced: 4bed3b34dcc01fe6661f39c0e5d2285b340f7cac . No further technical details are provid...

OSM <= 6.0.1- CSRF

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

MAL-2022-5131 Malicious code in osm-compare (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49b0e14451d493548f05cf4702c97fdd2f47e287d8801919e229430730b3d5f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-PXCF-V868-M492 Injection and Cross-site Scripting in osm-static-maps

This affects all versions of package osm-static-maps under 3.9.0. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the...

Injection and Cross-site Scripting in osm-static-maps

This affects all versions of package osm-static-maps under 3.9.0. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the...

osm-static-maps code injection vulnerability

osm-static-maps is a Google-like static maps Npm library for individual developers. An injection vulnerability exists in all versions of osm-static-maps, where user input provided to the package is passed directly to the template and fails to be escaped. An attacker can exploit this vulnerability...

Template Injection

osm-static-maps is vulnerable to template injection. Lack of validation of user input into the template parameter tileserverUrl allows an attacker to inject arbitrary Javascript/HTML in a user's browser, perform requests on behalf of the user or read arbitrary local files...

CVE-2020-7749

This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which...

CVE-2020-7749

This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which...

Design/Logic Flaw

This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which...

CVE-2020-7749 Server-side Request Forgery (SSRF)

This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which...

CVE-2020-7749

The CVE-2020-7749 issue affects all versions of osm-static-maps where user input is passed directly to a template without escaping ({{{ ... }}}). This enables injection of arbitrary HTML/JS, leading to XSS in the rendered page and, in server contexts (e.g., Puppeteer), potential SSRF and Local Fi...