1253 matches found
ROS-20250117-05
A vulnerability in the URL Handler component of the Tornado asynchronous networking library is related to URL redirection to an untrusted site. Exploitation of the vulnerability could allow an attacker acting remotely redirect a user to an arbitrary website and conduct a phishing attack...
CVE-2024-11328 CLUEVO LMS, E-Learning Platform <= 1.13.2 - Reflected Cross-Site Scripting
The CLUEVO LMS, E-Learning Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.13.2. This makes it possible for unauthenticated attackers to...
CVE-2024-12153 GDY Modular Content <= 0.9.92 - Reflected Cross-Site Scripting
The GDY Modular Content plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 0.9.92. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2024-12540
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-54288. Reason: This candidate is a reservation duplicate of CVE-2024-54288. Notes: All CVE users should reference CVE-2024-54288 instead of this candidate. All references and descriptions in this candidate have been...
CVE-2023-47225 WordPress Short URL plugin <= 1.6.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in KaizenCoders Short URL shorten-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Short URL: from n/a through = 1.6.8...
CVE-2024-56352
In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page...
CVE-2024-52593 Missing validation allows spoofed "origin" links in Misskey
Misskey is an open source, federated social media platform.In affected versions missing validation in NoteCreateService.insertNote, ApPersonService.createPerson, and ApPersonService.updatePerson allows an attacker to control the target of any "origin" links such as the "view on remote instance"...
CVE-2024-10880
CVE-2024-10880 affects the WordPress plugin JobBoardWP – Job Board Listings and Submissions (versions
CVE-2021-38134
Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.5.0000...
Smart4Web 安全漏洞
Smart4Web is a content management system from Smart4Web, Inc. A security vulnerability exists in versions prior to Smart4Web v.5.020241004. A remote attacker can exploit this vulnerability to execute arbitrary code via the error parameter in the URL...
CVE-2024-10647
CVE-2024-10647 affects the WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin. It is a Reflected Cross-Site Scripting vulnerability caused by remove_query_arg not being properly escaped in the URL, affecting all versions up to and including 1.9.244. Exploitation is possible by a...
CVE-2024-10647 WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL
The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.9.244. This makes it possible for unauthenticated...
CVE-2024-41673
Decidim is a participatory democracy framework. The version control feature used in resources is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.27.8...
CBL Mariner 2.0 Security Update: php (CVE-2024-5458)
The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-5458 advisory. - In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, due to a code logic error, filtering...
WordPress Pods plugin <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URL vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Pod Form Redirect URL vulnerability discovered by wesley wcraft in WordPress Plugin Pods versions = 3.2.1...
WordPress 3D FlipBook plugin <= 1.15.4 - Authenticated (Author+) Stored Cross-Site Scritping via Bookmark URL vulnerability
Authenticated Author+ Stored Cross-Site Scritping via Bookmark URL vulnerability discovered by Tim Coen in WordPress Plugin 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery versions = 1.15.4...
Design/Logic Flaw
The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will...
CVE-2024-27894 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying
The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will...
CVE-2024-26269
Cross-site scripting XSS vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML...