671 matches found
PT-2024-18284 · WordPress · Nextscripts: Social Networks Auto-Poster
Name of the Vulnerable Software and Affected Versions: NextScripts: Social Networks Auto-Poster plugin for WordPress versions up to, and including, 4.4.3 Description: The issue allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an...
PT-2024-32042 · WordPress · Import/Export Users/Customers Plugin For Wordpress
Name of the Vulnerable Software and Affected Versions: Import and export users and customers plugin for WordPress versions up to, and including, 1.26.6.1 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with administrator...
CVE-2024-4656: Improper Neutralization of Input During Web Page Generation
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user agent header in all versions up to, and including, 1.26.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress plugin Import and export users and customers 安全漏洞
WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the WordPress plugin Import...
Import and export users and customers < 1.26.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user agent header in all versions up to, and including, 1.26.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
VulnCheck KEV: CVE-2021-42071
In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header...
Boss Mini 1.4.0 - local file inclusion
Exploit Title: Boss Mini 1.4.0 - local file inclusion Date: 07/12/2023 Exploit Author: nltt0 https://github.com/nltt-br CVE: CVE-2023-3643 ''' / \ | | / | | / / | | \ --. | | / | |/ | ' \ / |/ / | --. \ | /\ | | | | | | | | | | \ // / /,||,|| ||, |/|// / | |/ ''' from requests import...
CVE-2023-38320
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a showpreauthpage NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing User-Agent header. Triggering this issue results in crashing OpenNDS a Denial-of-Service condition. This problem...
CVE-2023-38320
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a showpreauthpage NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing User-Agent header. Triggering this issue results in crashing OpenNDS a Denial-of-Service condition. This problem...
CVE-2023-38322
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a dobinauth NULL pointer dereference that be triggered with a crafted GET HTTP request with a missing User-Agent HTTP header. Triggering this issue results in crashing OpenNDS a Denial-of-Service condition. The issue...
PT-2023-26358
Name of the Vulnerable Software and Affected Versions OpenNDS Captive Portal versions prior to 10.1.2 Description An issue in OpenNDS Captive Portal can be triggered with a crafted GET HTTP request that has a missing User-Agent header, resulting in a NULL pointer dereference. This can cause OpenN...
CVE-2023-38320: NULL Pointer Dereference
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a showpreauthpage NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing User-Agent header. Triggering this issue results in crashing OpenNDS a Denial-of-Service condition. This problem...
Denial Of Service (DoS)
github.com/mattermost/mattermost-plugin-calls is vulnerable to Denial Of Service. The vulnerability due to function isMobilePostGA in utils.go there is no check for the length of fields after it splits the User-Agent string. This allows an attacker to send a request without a User-Agent header,...
Mattermost denial of service vulnerability
Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin...
CVE-2023-5967
Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin...
Design/Logic Flaw
Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin...
CVE-2023-5967 Denial of Service via crashing the Calls Plugin
Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin...
CVE-2023-5967 Denial of Service via crashing the Calls Plugin
Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin...
Mattermost Code Issues Vulnerabilities
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from not properly validating requests to the Calls plugin, which allows an attacker to crash the Calls plugin when sending a request without...
PT-2023-32449
Name of the Vulnerable Software and Affected Versions Mattermost affected versions not specified Description The issue arises from Mattermost's failure to properly validate requests to the Calls plugin. An attacker can exploit this by sending a request without a User Agent header, which can cause...