SEO ALert <= 1.59 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Go to Vanilla Beans » SEO Alert. 2. In "Slack...

K16445454: Vanilla Forums vulnerability CVE-2016-10073

Security Advisory Description The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request...

SUSE: Security Advisory (SUSE-SU-2022:2808-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MAL-2022-272 Malicious code in @feis-vanilla/vanilla-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e58bdb352befb50affcc8766b5c366b4fe3d58327d7ae6646e3df978b7c6642c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @feis-vanilla/vanilla-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e58bdb352befb50affcc8766b5c366b4fe3d58327d7ae6646e3df978b7c6642c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-271 Malicious code in @feis-vanilla/cms-intl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5acba4a5007bbdb759150c8b21641818c0544b61fffec01d2ee2a06618e04606 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2284 Malicious code in custom-script-vanilla-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84fc81c2b96e23984a6c8521174966b25105451fd5b8110b6c6244423b0c8457 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vanillaforums (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04d4eaee162f329e9ff159b3516e322fa2820d4e1f5df77c9a39daa865055dab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Improper Access Control in mautic/mautic

Description I couldn't find a suitable vulnerability type for this kind of issue, so this may be incorrect the default .htaccess file has some restrictions in the access to PHP files. Deny access via HTTP requests to all PHP files. Order deny,allow Deny from all ... Except those whitelisted bello...

CVE-2021-43785

@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a script tag into the page and execute maliciou...

CVE-2021-43785 Cross Site Scripting Vulnerability in @joeattardi/emoji-button

@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a script tag into the page and execute maliciou...

CVE-2021-39334

The Job Board Vanila WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the psjbexpin and the psjbcurrin parameters found in the /job-settings.php file which allowed attackers with administrative user access to inject arbitrary...

CVE-2010-4266

It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher...

CVE-2010-4264

It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side...

Cross site scripting

It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side...

Code injection

It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher...

CVE-2010-4266

CVE-2010-4266 affects Vanilla Forums prior to 2.0.10, with a dispatcher-related issue described as a potential linkbait vulnerability in the software. The available connected documents corroborate the affected product (Vanilla Forums) and version boundary (before 2.0.10). No explicit root-cause o...

CVE-2010-4266

It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher...

CVE-2010-4264

It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side...

CVE-2010-4264

Vulnerability: CVE-2010-4264 affects Vanilla Forums prior to 2.0.10, where a filename could contain arbitrary code that executes in the client (XSS). Affected product/versions: Vanilla Forums before 2.0.10. Root cause: filename-controlled input enabling client-side script execution. Impact: cross...