WordPress Optimole plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress plugin Optimole version 3.3.2 has a cross-site scripting vulnerability that stems from the failure of image optimization and...

CVE-2022-26188

TOTOLINK N600R V4.3.0cu.7570B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost...

WordPress plugin Optimole 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress plugin Optimole version 3.3.2 has a cross-site scripting vulnerability that stems from the failure of image optimization and...

PT-2022-17714

Name of the Vulnerable Software and Affected Versions TOTOLINK N600R version 4.3.0cu.7570 B20200620 Description A command injection issue was discovered via the "/setting/NTPSyncWithHost" API endpoint. This allows for potential exploitation. No information is provided about the estimated number o...

CVE-2022-26188: Improper Neutralization of Special Elements used in a Command

TOTOLINK N600R V4.3.0cu.7570B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost...

CVE-2022-1004

Accounted time is shown in the Ticket Detail View External Interface, even if ExternalFrontend::TicketDetailViewAccountedTimeDisplay is disabled...

SUSE-SU-2022:0909-1 Security update for glibc

This update for glibc fixes the following issues: - CVE-2022-23219: Fixed buffer overflow in sunrpc clntcreate for 'unix' bsc1194768 - CVE-2022-23218: Fixed buffer overflow in sunrpc svcunixcreate bsc1194770 - CVE-2021-3999: Fixed getcwd to set errno to ERANGE for size == 1 bsc1194640...

CVE-2022-26246

TMS v2.28.0 was discovered to contain a cross-site scripting XSS vulnerability in the component /TMS/admin/setting/mail/createorupdate...

CVE-2022-26246

TMS v2.28.0 was discovered to contain a cross-site scripting XSS vulnerability in the component /TMS/admin/setting/mail/createorupdate...

PT-2022-17739

Name of the Vulnerable Software and Affected Versions TMS version 2.28.0 Description A cross-site scripting XSS issue was found in the /TMS/admin/setting/mail/createorupdate component. Recommendations For TMS version 2.28.0, update to a version that includes a fix for this issue, as no specific...

CVE-2022-26246: Improper Neutralization of Input During Web Page Generation

TMS v2.28.0 was discovered to contain a cross-site scripting XSS vulnerability in the component /TMS/admin/setting/mail/createorupdate...

CVE-2022-27243

An issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting...

CVE-2022-27243

An issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting...

CVE-2022-27243

An issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting...

CVE-2022-27243: Undefined Security Weakness

An issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting...

User Profile Arbitrary Junction Creation Local Privilege Elevation

The user profile service, identified as ProfSrv, is vulnerable to a local privilege elevation vulnerability in its CreateDirectoryJunction function due to a lack of appropriate checks on the directory structure of the junctions it tries to link together. Attackers can leverage this vulnerability ...

CVE-2022-26998

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wpsenroleepin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26998

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wpsenroleepin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26998

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wpsenroleepin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

Sassy Social Share < 3.3.40 - Reflected Cross-Site Scripting

The plugin does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled which is the default setting, leading to a Reflected Cross-Site Scripting issue. Note: Vendor was notified on September 14th, 2021. PoC...