684 matches found
PT-2022-27668
Name of the Vulnerable Software and Affected Versions cyface Terms and Conditions Module versions prior to 2.0.11 Description A vulnerability has been found in the cyface Terms and Conditions Module, classified as problematic. The issue affects the returnTo function of the file...
CVE-2022-4589 cyface Terms and Conditions Module views.py returnTo redirect
A vulnerability has been found in cyface Terms and Conditions Module up to 2.0.9 and classified as problematic. Affected by this vulnerability is the function returnTo of the file termsandconditions/views.py. The manipulation leads to open redirect. The attack can be launched remotely. Upgrading ...
WordPress 5.3.x < 5.3.14 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS via wp-mail.php post by email. - An open redirect in wpnonceays. - Sender's email address is exposed in wp-mail.php. - A Cross-Site...
WordPress 4.5.x < 4.5.28 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS via wp-mail.php post by email. - An open redirect in wpnonceays. - Sender's email address is exposed in wp-mail.php. - A Cross-Site...
WordPress 4.0.x < 4.0.37 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS via wp-mail.php post by email. - An open redirect in wpnonceays. - Sender's email address is exposed in wp-mail.php. - A Cross-Site...
Information Exposure
Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to Information Exposure due to insufficient validation of user permissions on the REST-API endpoint for terms and tags. An attacker can access sensitive...
Information Exposure
Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to Information Exposure due to insufficient validation in the REST API endpoint for terms and tags. An attacker can access details about terms and tags fo...
GLSA-202209-07 : Mrxvt: Arbitrary Code Execution
The remote host is affected by the vulnerability described in GLSA-202209-07 Mrxvt: Arbitrary Code Execution - rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow potentially remote code execution because of improper handling of certain escape sequences ESC G Q. A response is...
DRUPAL-CONTRIB-2022-056
This module enables you to set content permissions based on taxonomy terms. The module doesn't sufficiently restrict access to translated and unpublished nodes. This vulnerability is mitigated by the fact that it only affects sites with translated content...
DRUPAL-CONTRIB-2022-055
This module enables you to restrict content via taxonomy terms and related permissions. The module doesn't sufficiently restrict cached content in certain circumstances. This vulnerability is mitigated by the fact that it only occurs when multiple entity types are enabled in the module...
Permissions by Term - Moderately critical - Access bypass - SA-CONTRIB-2022-056
This module enables you to set content permissions based on taxonomy terms. The module doesn't sufficiently restrict access to translated and unpublished nodes. This vulnerability is mitigated by the fact that it only affects sites with translated content...
Permissions by Term - Moderately critical - Access bypass - SA-CONTRIB-2022-055
This module enables you to restrict content via taxonomy terms and related permissions. The module doesn't sufficiently restrict cached content in certain circumstances. This vulnerability is mitigated by the fact that it only occurs when multiple entity types are enabled in the module...
KMSpico explained: No, KMS is not "kill Microsoft"
Thanks to Pieter Arntz and the Threat Intelligence Team who contributed to the research. A hack tool is a program that allows users to activate software even without a legitimate, purchased key. Hack tools are often used to root devices in order to among others remove barriers that stop users fro...
DRUPAL-CONTRIB-2022-051
This module provides a widget to transform entity reference fields into a more user-friendly tags input component with a great performance. The module doesn't sufficiently check access for the add operation. Users with permission to edit content can view and reference unpublished terms. The edit...
Page Generator Plugin < 1.6.5 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Got to Page Generator - Keywords - Add Keyword and put the following payload in the "Terms" field then...
PT-2022-3808 · Mozilla +1 · Firefox +1
Name of the Vulnerable Software and Affected Versions: Firefox for iOS versions prior to 101 Description: The issue is related to a lack of protection against SQL query structure exploitation. This could allow a remote attacker to send specially crafted data to the application, potentially...
GHSA-6CJ8-C359-P7Q9 Drupal vulnerable to Cross-site Scripting
Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...
CVE-2022-27243
An issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting...
