CVE-2023-46218

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a...

curl security vulnerability

curl is a tool for transferring data from or to a server. A security vulnerability exists in curl versions 7.46.0 through 8.4.0, which stems from a mixed-case flaw in the curl function that allows a malicious HTTP server to set super cookies in curl and then pass back more information...

PT-2023-8861 · Curl +11 · Curl +11

Name of the Vulnerable Software and Affected Versions: cURL affected versions not specified Description: This flaw allows a malicious HTTP server to set "super cookies" in cURL that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies...

CVE-2023-48281

Cross-Site Request Forgery CSRF vulnerability in Super Blog Me Broken Link Checker for YouTube allows Cross Site Request Forgery.This issue affects Broken Link Checker for YouTube: from n/a through 1.3...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Super Blog Me Broken Link Checker for YouTube allows Cross Site Request Forgery.This issue affects Broken Link Checker for YouTube: from n/a through 1.3...

CVE-2023-48281

CVE-2023-48281 concerns the WordPress plugin Broken Link Checker for YouTube. A CSRF flaw affects versions

PT-2023-30756 · Unknown · Super Blog Me Broken Link Checker For Youtube

Name of the Vulnerable Software and Affected Versions: Super Blog Me Broken Link Checker for YouTube versions 1.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions. This is a type of attack where an attacker tricks a user into...

Super Socializer < 7.13.55 - Missing Authorization

Description The Super Socializer plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions such as heateorsstwitcountnotificationread, heateorssgdprnotificationread, heateorssfbredirectionnotificationread,...

The vulnerability of the automation function of the FortiADC delivery controller, related to access control errors, allows a perpetrator to elevate their privileges to a super-administrator level.

The vulnerability of the FortiADC application delivery controller’s automation function is related to access control errors. Exploiting this vulnerability allows a malicious actor to elevate their privileges to super-administrator level through a specially crafted automation CLI script...

CVE-2021-37937

An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account...

CVE-2021-37937 Elasticsearch privilege escalation

An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account...

The vulnerability of the Super Socializer plugin of the WordPress content management system allows attackers to perform cross-site scripting attacks.

The vulnerability of the Super Socializer plugin of the WordPress content management system exists due to the lack of protective measures for website structures. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF

Description The plugin does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution. Submit the following form as a Super Admin notice that it does not contain a nonce. Despite the error,...

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF

Description The plugin does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution. 1. Ensure your WordPress...

CVE-2023-26205

An improper access control vulnerability CWE-284 in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated low-privileged attacker to escalate their privileges to superadmin via a specific crafted configuration of fabric...

CVE-2023-26205

An improper access control vulnerability CWE-284 in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated low-privileged attacker to escalate their privileges to superadmin via a specific crafted configuration of fabric...

CVE-2023-27417

Cross-Site Request Forgery CSRF vulnerability in Timo Reith Affiliate Super Assistent plugin = 1.5.1 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Timo Reith Affiliate Super Assistent plugin = 1.5.1 versions...

CVE-2023-27417

CVE-2023-27417 is a CSRF vulnerability in the WordPress plugin Affiliate Super Assistent (

CVE-2023-27417 WordPress Affiliate Super Assistent Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Timo Reith Affiliate Super Assistent plugin = 1.5.1 versions...