1907 matches found
Code injection
User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avo...
CVE-2023-41703
User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avo...
PT-2024-12961 · Softwarex · Softwarex
Name of the Vulnerable Software and Affected Versions: SoftwareX affected versions not specified Description: The issue arises from the improper sanitization of User ID references at mentions in document comments, allowing script code to be injected into a user's session when working with a...
GHSA-8V28-3G86-CHJ5
creationtimestamp| type| source ---|---|--- 2024-02-08 19:36:40+00:00| seen| https://t.me/ctinow/181586...
Event Tickets and Registration < 5.8.1 - Contributor+ Arbitrary Events Access
Description The plugin does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. e.g. draft, private, pending review, pw-protected, and trashed events. 1. ADMIN: Install Event Tickets 2. ADMIN: Install Event Tickets Plus...
CVE-2018-21030
creationtimestamp| type| source ---|---|--- 2024-02-01 09:07:07+00:00| seen| https://t.me/ctinow/177405...
CVE-2024-1006
A vulnerability was found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This issue affects some unknown processing of the file application/index/common.php of the component Cookie Handler. The manipulation of the argument NodUserId/NodUserToken leads to improper...
Sichuan Yougou Technology KuERP License Issue Vulnerability
Sichuan Yougou Technology KuERP is an e-commerce platform from Sichuan Yougou Technology, a Chinese company. An authorization issue vulnerability exists in Sichuan Yougou Technology KuERP 1.0.4 and earlier versions, which stems from a security issue in the checklogin function of...
GHSA-GWR4-PJ6R-2576
creationtimestamp| type| source ---|---|--- 2024-01-26 23:52:03+00:00| seen| https://t.me/arpsyndicate/3120...
PT-2024-15592 · Code Projects · Dormitory Management System
Name of the Vulnerable Software and Affected Versions: code-projects Dormitory Management System version 1.0 Description: A critical issue has been found in the Dormitory Management System, affecting some unknown functionality of the file modifyuser.php. The manipulation of the user id argument...
CentralSquare Security Breach
CentralSquare is an application from CentralSquare, Inc. CentralSquare suffers from a security vulnerability that stems from the web application's inability to validate a user's right to remove a contractor from an account with a specified user ID, which can be exploited by an attacker to remove ...
CVE-2023-39340
creationtimestamp| type| source ---|---|--- 2024-01-11 18:02:24+00:00| seen| https://t.me/ctinow/166679...
GHSA-MGQJ-HPHF-9588
creationtimestamp| type| source ---|---|--- 2024-01-11 08:56:59+00:00| seen| https://t.me/ctinow/166369...
CVE-2023-50771
creationtimestamp| type| source ---|---|--- 2024-01-10 13:37:24+00:00| seen| https://t.me/ctinow/165779...
GHSA-WF2X-8W6J-QW37
creationtimestamp| type| source ---|---|--- 2024-01-04 23:06:32+00:00| seen| https://t.me/ctinow/163286...
glibc: buffer overflow in ld.so leading to privilege escalation
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBCTUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBCTUNABLES environment variables when launching binaries with SUID permission to execute code...
CVE-2020-26625
A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the 'userid' parameter after the login portal...
CVE-2023-50422
creationtimestamp| type| source ---|---|--- 2024-01-01 17:41:37+00:00| seen| https://t.me/ctinow/161386...