PT-2023-25495 · Gnome +1 · Gnome Time Tracker +1

Name of the Vulnerable Software and Affected Versions: GNOME time tracker version 3.0.2 Description: The issue allows local attackers to execute arbitrary code via a crafted .tsv file when creating a new record. This is a result of a CSV Injection vulnerability in the GNOME time tracker...

PT-2023-27839 · Usermin · Usermin

Name of the Vulnerable Software and Affected Versions: Usermin version 2.000 Description: A Reflected Cross-site scripting XSS issue in the file manager tab allows remote attackers to inject arbitrary web script or HTML via the replace in results field while replacing the results under the tools...

PT-2023-27828 · Usermin · Usermin

Name of the Vulnerable Software and Affected Versions: Usermin version 2.001 Description: A Stored Cross-Site Scripting XSS vulnerability in the SSH configuration tab allows remote attackers to inject arbitrary web script or HTML via options for the host value while editing the host options...

CVE-2023-39652

theme volty tvcmsvideotab up to v4.0.0 was discovered to contain a SQL injection vulnerability via the component TvcmsVideoTabConfirmDeleteModuleFrontController::run...

Cross site scripting

jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit 87a49272728 which h...

PT-2023-27056 · Unknown · Tvcmsvideotab

Name of the Vulnerable Software and Affected Versions: theme volty tvcmsvideotab versions up to 4.0.0 Description: The issue is a SQL injection vulnerability. It occurs via the component TvcmsVideoTabConfirmDeleteModuleFrontController::run. Recommendations: For versions up to 4.0.0, as a temporar...

Cross-site Request Forgery (CSRF)

org.jenkins-ci.plugins, favorite-view is vulnerable to Cross-Site Request Forgery. The vulnerability exists due to the lack of validation in the HTTP endpoint which allows an attackers to add or remove views from another user's favorite views tab bar...

CVE-2023-40351

A cross-site request forgery CSRF vulnerability in Jenkins Favorite View Plugin 5.v77a37f62782d and earlier allows attackers to add or remove views from another user's favorite views tab bar...

FreeBSD : electron{22,23,24,25} -- multiple vulnerabilities (f3a35fb8-2d70-47c9-a516-6aad7eb222b1)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f3a35fb8-2d70-47c9-a516-6aad7eb222b1 advisory. - Use after free in WebRTC in Google Chrome prior to 115.0.5790.98 allowed a remote attacker t...

Use After Free

chromium is vulnerable to Use After Free. The vulnerability exists in the Tab Groups, which allows an attacker to engage in specific UI interactions causing heap corruptions via a maliciously crafted HTML page...

Design/Logic Flaw

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'startsha' value on merge requests page may lead to Denial of Service as Changes tab would not load...

CVE-2023-3900

Removed by vendor...

WordPress Plugin Bus Ticket Booking with Seat Reservation Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress Plugin Bus Ticket Booking with Seat...

CVE-2023-3730

Use after free in Tab Groups in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2023-3730

Use after free in Tab Groups in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2023-3730

Use after free in Tab Groups in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2023-3730

Use after free in Tab Groups in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2023-3730

CVE-2023-3730: Use-after-free in Tab Groups of Google Chrome/Chromium prior to 115.0.5790.98. Root cause is a Tab Groups use-after-free in Chrome/Chromium, enabling potential heap corruption when a user interacts with specific UI. Affected products include Google Chrome and Chromium-based browser...

CVE-2023-3730

Use after free in Tab Groups in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

PT-2023-25133 · WordPress · Woocommerce Pre-Orders

Name of the Vulnerable Software and Affected Versions: WooCommerce Pre-Orders WordPress plugin versions prior to 2.0.3 Description: The issue is related to a flawed CSRF check when processing tab actions. This could allow attackers to make logged-in admins perform unintended actions, such as...