EulerOS 2.0 SP9 : golang (EulerOS-SA-2023-2314)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service...

EulerOS 2.0 SP9 : golang (EulerOS-SA-2023-2334)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service...

Zinc Cross-site Scripting vulnerability

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’...

GHSA-7J6X-42MM-P7JM Zinc Cross-site Scripting vulnerability

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’...

golang: html/template: improper handling of JavaScript whitespace

A flaw was found in golang, where not all valid JavaScript white-space characters were considered white space. Due to this issue, templates containing white-space characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be...

golang: html/template: improper handling of JavaScript whitespace

A flaw was found in golang, where not all valid JavaScript white-space characters were considered white space. Due to this issue, templates containing white-space characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be...

Milesight MilesightVPN requestHandlers.js detail_device cross-site scripting (XSS) vulnerabilities

Talos Vulnerability Report TALOS-2023-1704 Milesight MilesightVPN requestHandlers.js detaildevice cross-site scripting XSS vulnerabilities July 6, 2023 CVE Number CVE-2023-24497,CVE-2023-24496 SUMMARY Cross-site scripting xss vulnerabilities exist in the requestHandlers.js detaildevice...

Cross site request forgery (csrf)

icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms perform the deletion action before user input is validated, including the cross site request forgery token. This issue is fixed in version...

Server-Side Template Injection

fiefserver is vulnerable to Server-Side Template Injection. The vulnerability exists because it does not properly sanitize the user input in the email template, which allows an attacker to inject and execute arbitrary code into the system...

Malicious code in wix-commerce-ticketing-nextjs-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0b99bb56f643f4526ad69d487c48bec96603f7a221baf7ed0637b6cdb74d3c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-967 Malicious code in wix-commerce-ticketing-nextjs-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0b99bb56f643f4526ad69d487c48bec96603f7a221baf7ed0637b6cdb74d3c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2021-4390

The Contact Form 7 Style plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2. This is due to missing or incorrect nonce validation on the managewppostsbeqesavepost function. This makes it possible for unauthenticated attackers to quick edit...

CVE-2020-36742

The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on the editmetavalue function. This makes it possible for unauthenticated attackers to edit meta field values vi...

CVE-2020-36742

The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on the editmetavalue function. This makes it possible for unauthenticated attackers to edit meta field values vi...

Cross site request forgery (csrf)

The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on the editmetavalue function. This makes it possible for unauthenticated attackers to edit meta field values vi...

CVE-2020-36742

CVE-2020-36742 relates to the WordPress Custom Field Template plugin. A CSRF vulnerability exists in versions up to 2.5.1 due to missing or incorrect nonce validation on the edit_meta_value() function, enabling unauthenticated attackers to edit meta field values via forged requests if they can tr...

CVE-2020-36742 Custom Field Template <= 2.5.1 - Cross-Site Request Forgery Bypass

The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on the editmetavalue function. This makes it possible for unauthenticated attackers to edit meta field values vi...

WordPress Plugin Custom Field Template 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site request forgery vulnerability exists in...

WordPress Plugin Contact Form 7 Style 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2023-11882 · WordPress · Custom Field Template

Name of the Vulnerable Software and Affected Versions: Custom Field Template plugin for WordPress versions up to, and including, 2.5.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the edit meta value function. This allows...