PT-2023-12956 · Nokia · Nokia Netact

Name of the Vulnerable Software and Affected Versions: Nokia NetAct version 22 Description: An issue was discovered in the Administration of Measurements website section, where a malicious user can edit or add the templateName parameter to include JavaScript code. This code is then stored and...

golang: html/template: improper handling of empty HTML attributes

A flaw was found in golang. Templates containing actions in unquoted HTML attributes, for example, "attr=." executed with empty input, could result in output that has unexpected results when parsed due to HTML normalization rules. This issue may allow the injection of arbitrary attributes into ta...

FakeSG enters the 'FakeUpdates' arena to deliver NetSupport RAT

Over 5 years ago, we began tracking a new campaign that we called FakeUpdates also known as SocGholish that used compromised websites to trick users into running a fake browser update. Instead, victims would end up infecting their computers with the NetSupport RAT, allowing threat actors to gain...

WordPress WordPress Everse Starter Sites – Elementor Templates Plugin < 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Everse Starter Sites – Elementor Templates Type Plugin Vulnerable versions 1.2.2 Fixed in 1.2.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8f53de574344 Credi...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin < 1.5.75 is vulnerable to Cross Site Scripting (XSS)

Software Unlimited Elements For Elementor Free Widgets, Addons, Templates Type Plugin Vulnerable versions 1.5.75 Fixed in 1.5.75 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Unlimited Elements PSID...

WordPress Ultimate Gutenberg – Custom Block Templates Plugin <= 2.5.1 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Gutenberg – Custom Block Templates Type Plugin Vulnerable versions = 2.5.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 729999fffaff Credits Rafie...

WordPress WPBricks – Library of Gutenberg Blocks & Templates Plugin <= 2.0.8 is vulnerable to Cross Site Scripting (XSS)

Software WPBricks – Library of Gutenberg Blocks & Templates Type Plugin Vulnerable versions = 2.0.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2ec32d8ecb22 Credits...

WordPress SKT Templates – Elementor & Gutenberg templates Plugin < 5.0.2 is vulnerable to Cross Site Scripting (XSS)

Software SKT Templates – Elementor & Gutenberg templates Type Plugin Vulnerable versions 5.0.2 Fixed in 5.0.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7a37d4fade99 Credits...

EulerOS 2.0 SP10 : golang (EulerOS-SA-2023-2382)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service...

CVE-2023-37582

creationtimestamp| type| source ---|---|--- 2023-07-15 10:35:02+00:00| published-proof-of-concept| https://t.me/proxybar/1626 2023-07-15 14:45:28+00:00| published-proof-of-concept| https://t.me/crackcodes/3898 2023-07-15 14:46:28+00:00| published-proof-of-concept|...

CVE-2021-4414

The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.5. This is due to missing or incorrect nonce validation on the wcalpreviewemails function. This makes it possible for unauthenticated attackers to generat...

CVE-2023-35870

When creating a journal entry template in SAP S/4HANA Manage Journal Entry Template - versions S4CORE 104, 105, 106, 107, an attacker could intercept the save request and change the template, leading to an impact on confidentiality and integrity of the resource. Furthermore, a standard template...

SAP S/4HANA 安全漏洞

SAP S/4HANA is an enterprise resource management software based on the SAP HANA in-memory database system from SAP, Germany. A security vulnerability exists in SAP S/4HANA that originates from the ability to intercept save requests and change templates, thereby affecting the confidentiality and...

CVE-2023-1119

creationtimestamp| type| source ---|---|--- 2023-07-10 20:23:59+00:00| seen| https://t.me/cibsecurity/66256 2024-12-12 20:42:31+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2023/CVE-2023-1119.yaml 2025-02-19 21:02:35+00:00| seen|...

CLSA-2023-1689009659 Update of alt-php

Backport the package from Ubuntu 18.04: New upstream version 2023c: - Egypt now uses DST again, from April through October. - This year Morocco springs forward April 23, not April 30. - Palestine delays the start of DST this year. - Much of Greenland still uses DST from 2024 on. The contents of...

golang: html/template: improper sanitization of CSS values

A flaw was found in golang where angle brackets were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in the CSS context unexpectedly closing, allowing for the injection of unexpected HMTL if...

CVE-2023-20133

A vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability exists because of insufficient validation of user-supplied input in Webex Events class...

golang: html/template: improper handling of JavaScript whitespace

A flaw was found in golang, where not all valid JavaScript white-space characters were considered white space. Due to this issue, templates containing white-space characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be...

Cross site request forgery (csrf)

The Contact Form 7 Style plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2. This is due to missing or incorrect nonce validation on the managewppostsbeqesavepost function. This makes it possible for unauthenticated attackers to quick edit...

GHSA-94PF-92HW-2HJC XWiki Platform vulnerable to Code injection through NotificationRSSService

Impact Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This can be reproduced with the following steps:...