12364 matches found
PT-2022-26329 · Unknown · Simple Cold Storage Management System
Name of the Vulnerable Software and Affected Versions: Simple Cold Storage Management System version 1.0 Description: The issue is related to SQL injection via the "/csms/admin/storages/manage storage.php" endpoint, specifically through the id parameter. This allows for potential unauthorized...
CVE-2022-42250
CVE-2022-42250 affects Simple Cold Storage Management System v1.0. The vulnerability is an SQL injection in /csms/admin/inquiries/view_details.php?id= due to lack of input validation on the id parameter. Descriptions across multiple sources (CNVD/CNNVD/Red Hat and others) indicate potential expos...
CVE-2022-42243
CVE-2022-42243 affects Simple Cold Storage Management System v1.0. The vulnerability is an SQL injection in the endpoint /csms/admin/storages/manage_storage.php?id= . Public records from CNVD/CNNVD/Red Hat/CVE feeds describe that a remote attacker can manipulate the database, potentially obtainin...
CVE-2022-42249
CVE-2022-42249 affects Simple Cold Storage Management System v1.0. The vulnerability is a SQL injection in the admin endpoint /csms/admin/storages/view_storage.php?id= (likely due to improper sanitization of the id parameter). This is rated high (CVSS 3.1: base score 7.2) with impact on confident...
CVE-2021-42045
An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. Simple polls allow users to create alerts by changing their User-Agent HTTP header and submitting a vote...
CVE-2021-42045
An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. Simple polls allow users to create alerts by changing their User-Agent HTTP header and submitting a vote...
simple-cms.nl Cross Site Scripting vulnerability OBB-2962741
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a Thunderbird user replying to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv="refresh" attribute and the content attribute specifying an URL. Thunderbird started a...
CVE-2022-3062
The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting...
CVE-2022-3024
The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored...
CVE-2022-3062
The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting...
CVE-2022-3062 Simple File List < 4.4.12 - Reflected Cross-Site Scripting
The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting...
CVE-2022-3062 Simple File List < 4.4.12 - Reflected Cross-Site Scripting
The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting...
CVE-2022-3062
CVE-2022-3062 affects the WordPress Simple File List plugin prior to 4.4.12. The vulnerability arises from not escaping parameters before outputting them in HTML attributes, enabling reflected Cross-Site Scripting. Impact is the execution of arbitrary JavaScript in the victim’s browser; remediati...
WordPress plugin Simple Bitcoin Faucets 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Cross-site request forgery...
WordPress plugin Simple File List 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
PT-2022-20029 · WordPress · Simple Bitcoin Faucets
Name of the Vulnerable Software and Affected Versions: The Simple Bitcoin Faucets WordPress plugin versions 1.7.0 and earlier Description: The issue is related to the lack of authorisation and CSRF in an AJAX action, allowing any authenticated users to call it and add/delete/edit Bonds. This coul...
CVE-2022-3024 Simple Bitcoin Faucets <= 1.7.0 - Unauthorised AJAX Call to Stored XSS
The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored...
CVE-2022-3024
The CVE-2022-3024 entry concerns the WordPress plugin Simple Bitcoin Faucets (versions ≤ 1.7.0). The vulnerability is due to missing authorization checks and CSRF protection in an AJAX action, enabling any authenticated user (e.g., subscribers) to call the action and add/delete/edit Bonds. It is ...
