Backdrop CMS 代码问题漏洞

Backdrop CMS is an open source content management system CMS. A code issue vulnerability exists in Backdrop CMS version 1.22.0, which stems from themes having an unrestricted file upload vulnerability that can be exploited by an attacker to remotely execute code...

CVE-2022-42092

Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. Note: Third parties dispute this and argue that advanced permissions are required...

PT-2022-23155 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.9 Discourse versions prior to 2.9.0.beta10 Description: The issue allows a moderator to create new and edit existing themes using the API when they should not have this capability. Recommendations: For versions...

Cross-site Scripting (XSS)

org.keycloak:keycloak-themes is vulnerable to cross-site scriptingXSS attacks. The library does not properly sanitize inputs in certain UI fields in client registration, which allows a malicious authenticated user to inject and execute malicious javascript on the admin console...

CVE-2022-37328

Authenticated author+ Stored Cross-Site Scripting XSS vulnerability in Themes Awesome History Timeline plugin = 1.0.5 at WordPress...

CVE-2022-37328 WordPress History Timeline plugin <= 1.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated author+ Stored Cross-Site Scripting XSS vulnerability in Themes Awesome History Timeline plugin = 1.0.5 at WordPress...

CVE-2022-37328

The CVE-2022-37328 entry concerns the WordPress plugin Themes Awesome History Timeline (versions

WordPress plugin Themes Awesome History Timeline 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2022-29476

Unauthenticated Stored Cross-Site Scripting XSS vulnerability in 8 Degree Themes otification Bar for WordPress plugin = 1.1.8 at WordPress...

CVE-2022-29476

Unauthenticated Stored Cross-Site Scripting XSS vulnerability in 8 Degree Themes otification Bar for WordPress plugin = 1.1.8 at WordPress...

CVE-2022-29476

CVE-2022-29476 affects the WordPress plugin "Notification Bar for WordPress" (8 Degree Themes) version

PT-2022-19641 · 8 Degree Themes · 8 Degree Themes Notification Bar

Name of the Vulnerable Software and Affected Versions: 8 Degree Themes Notification Bar for WordPress plugin version 1.1.8 and earlier Description: The issue is an Unauthenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the...

WordPress plugin 8 Degree Themes otification Bar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

CVE-2022-2921

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update...

CVE-2022-29476

Unauthenticated Stored Cross-Site Scripting XSS vulnerability in 8 Degree Themes otification Bar for WordPress plugin = 1.1.8 at WordPress...

Drupal core - Moderately critical - Access Bypass - SA-CORE-2022-013

Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules...

Targeted attack on Government Agencies

Targeted Attack on Government Agencies By Sushant Kumar Arya, Mohsin Dalla · July 13, 2022 Executive summary The Trellix Email Security Research Team has discovered a malicious campaign targeting government agencies of Afghanistan, India, Italy, Poland, and the United States since 2021. The attac...

Stop using phishing as a measure of your cyber awareness culture

If I had a penny for every time someone said to me “let’s measure our security culture by phishing our staff” I’d probably be able to fill my car up. It’s a really easy thing to do, you carry out some online training and typically they come with phishing simulations as a free or low cost add on. ...

CVE-2022-1951 Core Plugin for Kitestudio Themes < 2.3.1 - Reflected Cross-Site-Scripting

The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected...

keycloak-services: ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader

ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available...