PT-2023-27650 · Opencrx · Opencrx

Name of the Vulnerable Software and Affected Versions: OpenCRX version 5.2.0 Description: The issue allows for HTML injection via Activity Saved Search Creation. Recommendations: For OpenCRX version 5.2.0, update to a version that fixes this issue, as no specific workaround is provided for this...

openCRX Security Vulnerabilities

openCRX is an open source Crm software. A security vulnerability exists in openCRX version 5.2.0, which originated from a vulnerability that allows attackers to conduct HTML injection attacks via the component Activity Saved Search Creation...

CVE-2023-40813

OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation...

GHSA-897X-XVJ8-42RQ Zip slip in mleap

FileUtil.extract enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directory. When creating an instance of TensorflowModel using the savedmodel format and an exported tensorflow model, the apply function invokes th...

CVE-2023-5245 Using MLeap for loading a saved model (zip archive) can lead to path traversal/arbitrary file creation and possibly remote code execution.

FileUtil.extract enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directory. When creating an instance of TensorflowModel using the savedmodel format and an exported tensorflow model, the apply function invokes th...

WP Not Login Hide <= 1.0 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Visit the "WPNLH" interface availab...

CVE-2023-5454

The Templately WordPress plugin before 2.2.6 does not properly authorize the saved-templates/delete REST API call, allowing unauthenticated users to delete arbitrary posts...

PT-2023-32113 · WordPress · Templately

Name of the Vulnerable Software and Affected Versions: Templately WordPress plugin versions prior to 2.2.6 Description: The issue concerns improper authorization of the saved-templates/delete API endpoint, allowing unauthenticated users to delete arbitrary posts. Recommendations: For versions pri...

SUSE CVE-2023-29454

Stored or persistent cross-site scripting XSS is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload e.g., in a database or server-side text files, and finally, the application unintentionally executes the payload for every victi...

Introducing: ‘Saved Filters’ in InsightCloudSec

Last year, when we launched Layered Context in InsightCloudSec, we knew we had something great on our hands. Not just because we provided a single view for cloud security practitioners to see their full cloud risk posture though, if we do say so ourselves, that’s pretty sweet. No, we knew we had...

GHSA-2J26-J953-2RPH Stored cross site scripting on saved presets

Concrete CMS previously concrete5 before 9.2 is vulnerable to Stored XSS on Saved Presets on search...

Stored cross site scripting on saved presets

Concrete CMS previously concrete5 before 9.2 is vulnerable to Stored XSS on Saved Presets on search...

CVE-2023-28474

Concrete CMS previously concrete5 in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search...

CVE-2023-28474

Concrete CMS previously concrete5 in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search...

Design/Logic Flaw

Concrete CMS previously concrete5 in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search...

CVE-2023-28474

Concrete CMS (formerly concrete5) versions 9.0 through 9.1.3 are affected by a Stored XSS vulnerability in the Saved Presets on search feature. The root cause is lack of proper sanitization when saving presets for search, enabling an attacker to inject script that could be executed in other users...

CVE-2023-28474

Concrete CMS previously concrete5 in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search...

CVE-2023-28474

Concrete CMS previously concrete5 in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search...

PT-2023-21744 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS previously concrete5 versions 9.0 through 9.1.3 Concrete CMS previously concrete5 versions prior to 9.2 Description: The issue is related to Stored XSS on Saved Presets on search. This means that an attacker can store malicious...

CVE-2023-28474

Concrete CMS previously concrete5 in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search...