116 matches found
CVE-2023-5745
The Reusable Text Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text-blocks' shortcode in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...
WordPress Plugin Reusable Text Blocks Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
CVE-2023-5745 Reusable Text Blocks <= 1.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode
The Reusable Text Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text-blocks' shortcode in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...
[SECURITY] Fedora 38 Update: libqb-2.0.8-1.fc38
A "Quite Boring" library that provides high-performance, reusable features fo r client-server architecture, such as logging, tracing, inter-process communication IPC, and polling...
[SECURITY] Fedora 38 Update: python-django-filter-23.2-1.fc38
Django-filter is a reusable Django application for allowing users to filter querysets dynamically...
Serenity / StartSharp Software File Upload / XSS / User Enumeration / Reusable Tokens
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: Serenity and StartSharp Software vulnerable version: 6.7.1 fixed version: 6.7.1 or higher CVE number: CVE-2023-31285, CVE-2023-31286,...
WordPress Reusable Blocks Extended Plugin <= 0.9 is vulnerable to Cross Site Request Forgery (CSRF)
Software Reusable Blocks Extended Type Plugin Vulnerable versions = 0.9 Fixed in 0.9.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27611 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID b5d0490a0c0b Credits Rio Darmawan...
DRUPAL-CONTRIB-2023-009
This module provides a new UI experience for node editing - Gutenberg editor. This vulnerability can cause DoS by using reusable blocks improperly. This vulnerability is mitigated by the fact an attacker must have "use gutenberg" permission to exploit it...
Gutenberg - Less critical - Denial of Service - SA-CONTRIB-2023-009
This module provides a new UI experience for node editing - Gutenberg editor. This vulnerability can cause DoS by using reusable blocks improperly. This vulnerability is mitigated by the fact an attacker must have "use gutenberg" permission to exploit it...
Observable Timing Discrepancy in Login Portal
Description An observable discrepancy in response times is present in the login portal. When brute forcing valid email accounts, the timing on a valid account is significantly higher than that of an invalid user account. This is likely due to the use of Bcrypt's compare function being utilized by...
CVE-2022-39326 kartverket/github-workflows's run-terraform allows for RCE via terraform plan
kartverket/github-workflows are shared reusable workflows for GitHub Actions. Prior to version 2.7.5, all users of the run-terraform reusable workflow from the kartverket/github-workflows repo are affected by a code injection vulnerability. A malicious actor could potentially send a PR with a...
PEAR Archive_Tar Improper Link Resolution Vulnerability
PEAR ArchiveTar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party...
VIewComponent Cross-Site Scripting Vulnerability
VIewComponent is a framework for building reusable, testable and encapsulated view components in Ruby on Rails. VIewComponent suffers from a cross-site scripting vulnerability that stems from data received via user input and passed as interpolated parameters to the translat method not being clean...
Laravel Fortify 安全漏洞
Laravel Fortify is a front-end agnostic authentication backend implementation of Laravel from the Laravel community. A security vulnerability exists in Laravel Fortify versions prior to 1.11.1, which stems from software that allows reuse for a short period of time...
[SECURITY] Fedora 35 Update: python-django-filter-21.1-1.fc35
Django-filter is a reusable Django application for allowing users to filter querysets dynamically...
[SECURITY] Fedora 34 Update: python-django-filter-21.1-1.fc34
Django-filter is a reusable Django application for allowing users to filter querysets dynamically...
[SECURITY] Fedora 34 Update: php-pear-1.10.12-9.fc34
PEAR is a framework and distribution system for reusable PHP components. This package contains the basic PEAR components...
keycloak: reusable "state" parameter at redirect_uri endpoint enables possibility of replay attacks
A flaw was found in Keycloak, where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks...