266 matches found
CVE-2023-35818
An issue was discovered on Espressif ESP32 3.0 ESP32rev300 ROM devices. An EMFI attack on ECO3 provides the attacker with a capability to influence the PC value at the CPU context level, regardless of Secure Boot and Flash Encryption status. By using this capability, the attacker can exploit...
CVE-2023-36201
An issue in JerryscriptProject jerryscript v.3.0.0 allows an attacker to obtain sensitive information via a crafted script to the arrays...
JerryScript 安全漏洞
JerryScript is a lightweight JavaScript engine from the Jerryscript Project. A security vulnerability exists in JerryscriptProject jerryscript version v.3.0.0. An attacker exploited the vulnerability to obtain sensitive information via a specially crafted array script...
CVE-2023-36201
An issue in JerryscriptProject jerryscript v.3.0.0 allows an attacker to obtain sensitive information via a crafted script to the arrays...
PT-2023-24680 · Zxcvbn-Ts · Zxcvbn-Ts
Name of the Vulnerable Software and Affected Versions: zxcvbn-ts versions prior to 3.0.2 Description: This issue affects users running on the NodeJS platform who are using the second argument of the zxcvbn function. It can result in unbounded resource consumption as the user inputs array is...
PT-2023-24223 · Crocoblock · Crocoblock Jetformbuilder
Name of the Vulnerable Software and Affected Versions: Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin versions 3.0.6 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into...
CVE-2022-4761 Post Views Count <= 3.0.2 - Contributor+ Stored XSS in Shortcode
The Post Views Count WordPress plugin through 3.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
SUSE CVE-2020-1955
CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called requirevaliduserexceptforup. It was meant as an extension to the long standing setting requirevaliduser, which in turn requires that any and all requests to CouchDB will...
SUSE CVE-2021-3478
There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to be processed by OpenEXR could consume excessive system memory. The greatest impact of this flaw is to system availability...
CVE-2022-34452
PowerPath Management Appliance with versions 3.3, 3.2, 3.1 & 3.0 contains sensitive information disclosure vulnerability. An Authenticated admin user can able to exploit the issue and view sensitive information stored in the logs...
PT-2022-8296 · Github · Hide Files On Github
Name of the Vulnerable Software and Affected Versions: Hide Files on GitHub versions up to 2.x Description: A problematic issue has been found in Hide Files on GitHub, affecting the function addEventListener of the file extension/options.js. This issue leads to cross-site scripting and can be...
PT-2022-24569 · WordPress · The Car Dealer (Dealership)/Vehicle Sales Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: The Car Dealer Dealership and Vehicle sales WordPress Plugin versions prior to 3.05 Description: The issue is related to improper authorization and CSRF in an AJAX action. This allows any authenticated users, such as subscribers, to call the...
CVE-2022-3858
CVE-2022-3858 affects the WordPress plugin Chaty / Floating Chat Widget prior to version 3.0.3. The issue is an SQL injection caused by improper sanitisation/escaping of a parameter before it is used in a SQL statement, making it exploitable by users with a role as low as admin. Documented impact...
CVE-2022-43097
Phpgurukul User Registration & User Management System v3.0 was discovered to contain multiple stored cross-site scripting XSS vulnerabilities via the firstname and lastname parameters of the registration form & login pages...
CVE-2022-41618
Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin = 3.00 on WordPress...
WordPress plugin floating-div 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
Blogifier 跨站脚本漏洞
Blogifier is a lightweight open source blogging system written in ASP.NET Core. A security vulnerability exists in Blogifier version 3.0, which originates from a file upload vulnerability in the /api/storage/upload/PostImage page. An attacker can exploit this vulnerability to execute arbitrary we...
PT-2022-20733 · Itop +1 · Itop +1
Name of the Vulnerable Software and Affected Versions: ITOP version 3.0.1 Description: A cross-site scripting XSS issue was found in ITOP. The vulnerability can be exploited via the "/itop/pages/ajax.render.php" API endpoint. Recommendations: For ITOP version 3.0.1, as a temporary workaround,...
Mattermost Server allows System Admin to modify LDAP account names and email addresses
An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account...