12770 matches found
Dreamer CMS Cross-Site Request Forgery Vulnerability
Dreamer CMS is a dreamer content management system by Junnan Wang, an individual developer in China. A security vulnerability exists in Dreamer CMS version v4.1.3. An attacker can exploit this vulnerability to conduct cross-site request forgery CSRF attacks via the component /admin/variable/add...
CVE-2023-45907: Cross-Site Request Forgery (CSRF)
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/variable/delete...
CVE-2023-45905: Cross-Site Request Forgery (CSRF)
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/variable/add...
CVE-2023-45904
Dreamer CMS v4.1.3 is affected by a Cross‑Site Request Forgery (CSRF) vulnerability in the /variable/update component. The issue enables unauthorized actions to be performed on behalf of an authenticated user. Exploitation details are not provided beyond the component path in the connected source...
Dreamer CMS Cross-Site Request Forgery Vulnerability
Dreamer CMS is a dreamer content management system by Junnan Wang, an individual developer in China. A security vulnerability exists in Dreamer CMS version v4.1.3. An attacker can exploit this vulnerability to conduct cross-site request forgery CSRF attacks via component/variable/update...
CVE-2023-45904: Cross-Site Request Forgery (CSRF)
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /variable/update...
PT-2023-29761 · Unknown · Dreamer Cms
Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A Cross-Site Request Forgery CSRF issue was discovered in Dreamer CMS via the component /admin/variable/delete. This allows for unauthorized actions to be performed on the application. Recommendations: F...
CVE-2023-45907
Dreamer CMS v4.1.3 contains a Cross-Site Request Forgery (CSRF) in the /admin/variable/delete component. The vulnerability is recorded as CVE-2023-45907 with CVSS v3.1 base score 8.8 (HIGH); attack vector is NETWORK, no privileges required, user interaction required, and impact to confidentiality...
CVE-2023-45907
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/variable/delete...
PT-2023-29758 · Unknown · Dreamer Cms
Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A Cross-Site Request Forgery CSRF issue was discovered in Dreamer CMS via the component "/variable/update". This allows for unauthorized actions to be performed on behalf of a user. Recommendations: For...
CVE-2023-45905
Dreamer CMS v4.1.3 is affected by a Cross-Site Request Forgery (CSRF) in the /admin/variable/add endpoint. The CVE-2023-45905 details indicate high impact with CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Root cause appears to be CSRF in the variable management feature. No official patch/versio...
PT-2023-29759 · Unknown · Dreamer Cms
Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A Cross-Site Request Forgery CSRF issue was discovered in Dreamer CMS via the /admin/variable/add API endpoint. This allows an attacker to perform unauthorized actions on the system. Recommendations: For...
Cross site scripting
The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHPSELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin...
CVE-2023-4290 WP Matterport Shortcode < 2.1.7 - Reflected XSS
The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHPSELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin...
CVE-2023-38312
A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client with remote control access to a game server to read arbitrary files from the underlying server via the motdfile console variable...
CVE-2023-38312
A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client with remote control access to a game server to read arbitrary files from the underlying server via the motdfile console variable...
CVE-2023-38312
A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client with remote control access to a game server to read arbitrary files from the underlying server via the motdfile console variable...
CVE-2023-38312: Improper Limitation of a Pathname to a Restricted Directory
A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client with remote control access to a game server to read arbitrary files from the underlying server via the motdfile console variable...
Valve Counter-Strike 2 Path Traversal Vulnerability
Valve Counter-Strike 2 is an online game by Valve Corporation. A security vulnerability exists in Valve Counter-Strike 2 version 8684, which stems from the presence of a directory traversal vulnerability that allows an attacker to read arbitrary files from the underlying server via the motdfile...
