CVE-2022-0093

An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab allows a user with an expired password to access sensitive information through RSS feeds...

CVE-2022-0093

Removed by vendor...

PT-2022-12974 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 14.4.5 GitLab versions 14.5.0 through 14.5.3 GitLab versions 14.6.0 through 14.6.1 Description: An issue has been discovered in GitLab that allows a user with an expired password to access sensitive information throug...

WordPress WP RSS Aggregator plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WP RSS Aggregator plugin has a cross-site scripting vulnerability in versions prior to 4.19.3, which...

CVE-2021-24988

The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprssdismissaddonnotice AJAX action missing authorisation and CSRF checks, allowing any authenticated...

CVE-2021-24988

The CVE affects the WordPress WP RSS Aggregator plugin, versions prior to 4.19.3. Root cause: unsanitised/uncleaned data output in the System Info admin dashboard due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks. Impact: stored XSS where an authenticated use...

PT-2021-16394 · WordPress · Wp Rss Aggregator

Name of the Vulnerable Software and Affected Versions: WP RSS Aggregator versions prior to 4.19.3 Description: The issue is related to a Stored XSS problem. It occurs because data is not properly sanitised and escaped before being output in the System Info admin dashboard. This is due to the wprs...

Fedora: Security Advisory for rss-glx (FEDORA-2021-b58af96f33)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2021-24768

The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfilteredhtml capability is disallowed, which could lead to Cross-Site Scripting issues...

CVE-2021-24768

The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfilteredhtml capability is disallowed, which could lead to Cross-Site Scripting issues...

Cross site scripting

The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfilteredhtml capability is disallowed, which could lead to Cross-Site Scripting issues...

CVE-2021-24768

CVE-2021-24768 affects the WordPress WP RSS Aggregator plugin prior to 4.19.2. The issue is improper sanitisation/escaping of the URL to the Blacklist field, allowing malicious HTML to be stored by high-privilege users even when unfiltered_html is disallowed, enabling stored Cross-Site Scripting ...

WordPress WP RSS Aggregator plugin <= 4.19.2 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress WP RSS Aggregator plugin versions = 4.19.2. Solution Update the WordPress WP RSS Aggregator plugin to the latest available version at least 4.19.3...

WP RSS Aggregator < 4.19.3 - Subscriber+ Stored Cross-Site Scripting

The plugin does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprssdismissaddonnotice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and se...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. The WordPress WP RSS Aggregator plugin suffer...

Fedora: Security Advisory for rss-glx (FEDORA-2021-df1fa3d3e0)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 35 Update: rss-glx-0.9.1.p-50.fc35

A port of the Really Slick Screensavers to GLX. Provides several visually impressive and graphically intensive screensavers. Note that this package contains only the display hacks themselves; you will need to install the appropriate subpackage for your desktop environment in order to use them as...

Mozilla Firefox Security Advisory (MFSA2012-33) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Cross site scripting

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24793

CVE-2021-24793 references the WPeMatico RSS Feed Fetcher WordPress plugin, before version 2.6.12, which does not escape the feed URL added to a campaign before outputting it in an attribute. This enables stored Cross‑Site Scripting (XSS) when exploited by high‑privilege users, even when unfiltere...