Fancier Author Box by ThematoSoup <= 1.4 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Open the setting page of this plugin. 2. There...

Fancier Author Box by ThematoSoup <= 1.4 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Open the setting page of this plugin. 2...

Find and Replace All < 1.3 - Reflected Cross Site Scripting

The plugin does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue. PoC...

PT-2022-24190 · Unknown · Webfactory Under Construction Plugin

Name of the Vulnerable Software and Affected Versions: WebFactory Under Construction Plugin affected versions not specified Description: A problematic vulnerability has been found in the WebFactory Under Construction Plugin, affecting the Plugin Setting Handler component. This issue leads to...

PT-2022-24144 · Unknown · Pdf & Print Plugin

Name of the Vulnerable Software and Affected Versions: PDF & Print Plugin affected versions not specified Description: A vulnerability was found in the PDF & Print Plugin, affecting an unknown part of the component Setting Handler. The issue leads to cross-site scripting and can be initiated...

November 1, 2022, update for Office 2016 (KB5002306)

None None...

SUSE-SU-2022:3750-1 Security update for SUSE Manager Server 4.3

This update fixes the following issues: cobbler: - Consider case of 'nextserver' being a hostname during migration of Cobbler collections. - Fix problem with 'proxyurlext' setting being None type. - Fix settings migration schema to work while upgrading on existing running Uyuni and SUSE Manager...

[VPN Plugin] Transfer Login keeps Loading with Non-English language setting

In Citrix Gateway VPN environment, you may observe the following issue when "Transfer Login": After clicking "Transfer" on Client VPN plugin, the button keepsspinning loading and stuck. Logs investigation show the following clues: Problem can only be observed in Non-English language setting Plugi...

Tenda AC15 缓冲区错误漏洞

The Tenda AC15 is a wireless router from the Chinese company Tenda. The Tenda AC15 suffers from a buffer overflow vulnerability that originates from the timeZone parameter of the formfastsettingwifiset function that lacks length validation for input data. An attacker could exploit the vulnerabili...

CVE-2022-43259

Tenda AC15 V15.03.05.18 was discovered to contain a stack overflow via the timeZone parameter in the formfastsettingwifiset function...

CVE-2022-3547

A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /csms/admin/?page=systeminfo of the component Setting Handler. The manipulation of the argument System Name/System Short Name lead...

CVE-2022-3547

A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /csms/admin/?page=systeminfo of the component Setting Handler. The manipulation of the argument System Name/System Short Name lead...

Cross site scripting

A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /csms/admin/?page=systeminfo of the component Setting Handler. The manipulation of the argument System Name/System Short Name lead...

CVE-2022-3547: Improper Neutralization

A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /csms/admin/?page=systeminfo of the component Setting Handler. The manipulation of the argument System Name/System Short Name lead...

PT-2022-22845 · Sourcecodester · Sourcecodester Simple Cold Storage Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Cold Storage Management System version 1.0 Description: A problem was found in the Setting Handler component, specifically affecting the /csms/admin/?page=system info file. The issue arises from the manipulation of the...

PicUploader 跨站脚本漏洞

PicUploader is a graphic bed tool written in php by Bruce's personal developer. It helps you to quickly upload your images to a cloud image bed and automatically return Markdown-formatted links to the clipboard. A security vulnerability exists in PicUploader version v2.6.3, which stems from a...

PT-2022-25873 · Unknown · Picuploader

Name of the Vulnerable Software and Affected Versions: PicUploader version 2.6.3 Description: A cross-site scripting XSS issue was found in the setStorageParams function within SettingController.php. Recommendations: For PicUploader version 2.6.3, update the SettingController.php file to fix the...

Tenda AC18 fast_setting_wifi_set stack overflow vulnerability

The Tenda AC18 is a router from the Chinese company Tenda. Tenda AC18 V15.03.05.19 suffers from a stack overflow vulnerability, which stems from the fastsettingwifiset function not performing a size check on incoming data, and can be exploited by an attacker to cause remote code execution or deni...

Tenda AC15 fast_setting_wifi_set stack overflow vulnerability

The Tenda AC15 is a wireless router from the Chinese company Tenda. A stack overflow vulnerability exists in Tenda AC15 router version V15.03.05.19, which originates from the list parameter of the fastsettingwifiset function that does not perform a size check on the input data, and can be exploit...

CVE-2022-3076

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example...