591 matches found
VIewComponent 跨站脚本漏洞
VIewComponent is a framework for building reusable, testable and encapsulated view components in Ruby on Rails. VIewComponent suffers from a cross-site scripting vulnerability that stems from data received via user input and passed as interpolated parameters to the translat method not being clean...
WordPress WordPress Google Translate plugin <= 1.3 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress WordPress Google Translate plugin versions = 1.3. Solution No patched version available...
WordPress WordPress Google Translate plugin <= 1.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WordPress Google Translate plugin versions = 1.3. Solution No patched version available...
Wordpress Plugin Translate WordPress with GTranslate 跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...
CVE-2022-23850
xhtmltranslateentity in xhtml.c in epub2txt aka epub2txt2 through 2.02 allows a stack-based buffer overflow via a crafted EPUB document...
PT-2022-16292 · Epub2Txt · Epub2Txt
Name of the Vulnerable Software and Affected Versions: epub2txt aka epub2txt2 versions 2.02 and earlier Description: The issue allows a stack-based buffer overflow via a crafted EPUB document. This is due to the xhtml translate entity function in xhtml.c. Recommendations: For versions 2.02 and...
WordPress Loco Translate Plugin < 2.5.4 PHP Injection Vulnerability
The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
CVE-2021-24721
The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations...
CVE-2021-24721
The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations...
CVE-2021-24594
The Translate WordPress – Google Language Translator WordPress plugin before 6.0.12 does not sanitise and escape some of its settings before outputting it in various pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2021-24721
CVE-2021-24721 affects the WordPress plugin Loco Translate prior to version 2.5.4 . The vulnerability arises because data inputs saved by the plugin can be renamed to a file ending in “.php,” allowing an authenticated translator user to inject PHP code into web‑accessible PHP files. Impact is tha...
CVE-2021-24721 Loco Translate < 2.5.4 - Authenticated PHP Code Injection
The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations...
CVE-2021-24594
CVE-2021-24594 affects the Translate WordPress – Google Language Translator plugin for WordPress up to version 6.0.12. The root cause is insufficient sanitization/escaping of certain plugin settings before output, allowing stored Cross-Site Scripting by high-privilege users even when unfiltered_h...
Loco Translate < 2.5.4 - Authenticated PHP Code Injection
The plugin mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations. PoC 1. Using a User with the translator role,...
Loco Translate < 2.5.4 - Authenticated PHP Code Injection
The plugin mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations. 1. Using a User with the translator role, navigate...
WordPress Loco Translate plugin <= 2.5.3 - Authenticated PHP Code Injection vulnerability
Authenticated PHP Code Injection vulnerability discovered by Tomi Ashari in WordPress Loco Translate plugin versions = 2.5.3. Solution Update the WordPress Loco Translate plugin to the latest available version at least 2.5.4...
CVE-2021-42049
The CVE-2021-42049 entry concerns MediaWiki’s Translate extension (up to version 1.36.2). The root cause is an oversight-related permission flaw that lets oversighters undo or miss-oversight on pages with suppressed info (e.g., PII), effectively whitewashing revisions. The documented impact is a ...
CVE-2021-42049
An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or oversight on pages where they suppressed information such as PII. This allows oversighters to whitewash revisions...
PT-2021-23488 · Mediawiki +1 · Translate Extension +2
Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.36.2 Description: An issue in the Translate extension allows oversighters to whitewash revisions by preventing them from undoing revisions or oversight on pages where they suppressed information, such as personall...