Analytics-dashboard-widget 跨站脚本漏洞

Analytics-dashboard-widget is an analytics dashboard widget from Sterc open source. A cross-site scripting vulnerability exists in Sterc Analytics-dashboard-widget version 1.0.5 and earlier. An attacker could exploit this vulnerability to perform cross-site scripting attacks...

WordPress plugin Flowplayer Video Player 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

Quote-O-Matic <= 1.0.5 - Admin+ SQLi

The plugin does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. https://example.com/wp-admin/edit.php?page=quote-o-matic.php&sortby=qomID+AND+SELECT+3477+FROM+SELECTSLEEP5DhVP...

CVE-2022-23472 Use of insecure random number generator in Passeo

Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python random library for random value selection. The python random library warns that it should not be used for security purposes due to its reliance on a non-cryptographically secure random number generator...

WordPress Flowplayer Video Player plugin <= 1.0.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by Lana Codes in WordPress Flowplayer Video Player plugin versions = 1.0.4. Solution Update the WordPress Flowplayer Video Player plugin to the latest available version at least 1.0.5...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound which allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface. Remediation Upgrade sha3 to version 1.0.5 or higher. Reference...

PT-2022-23928 · WordPress · Themes Awesome History Timeline

Name of the Vulnerable Software and Affected Versions: Themes Awesome History Timeline plugin versions 1.0.5 and earlier Description: The issue is an Authenticated Stored Cross-Site Scripting XSS vulnerability. It affects the Themes Awesome History Timeline plugin at WordPress, allowing potential...

PT-2022-20961 · Unknown · Openremote

Name of the Vulnerable Software and Affected Versions: OpenRemote versions prior to 1.0.5 Description: An issue in OpenRemote allows attackers to execute arbitrary code via a crafted Groovy rule. Recommendations: For OpenRemote versions prior to 1.0.5, update to version 1.0.5 or later to resolve...

History Timeline <= 1.0.5 - Author+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks...

CVE-2021-40900

A Regular Expression Denial of Service ReDOS vulnerability was discovered in regexfn v1.0.5 when validating crafted invalid emails...

CVE-2021-40897

A Regular Expression Denial of Service ReDOS vulnerability was discovered in split-html-to-chars v1.0.5 when splitting crafted invalid htmls...

CVE-2021-40897

A Regular Expression Denial of Service ReDOS vulnerability was discovered in split-html-to-chars v1.0.5 when splitting crafted invalid htmls...

PT-2022-11325 · Unknown · Split-Html-To-Chars

Name of the Vulnerable Software and Affected Versions: split-html-to-chars version 1.0.5 Description: A Regular Expression Denial of Service ReDOS issue was found in the software when it processes crafted invalid HTML. This occurs due to inefficient regular expression patterns that can lead to...

WordPress plugin Active Products Tables for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Active Products Tables for WooCommerce plugin version prior to 1.0.5 has a cross-site scripting...

PT-2022-11328 · Regexfn · Regexfn

Name of the Vulnerable Software and Affected Versions: regexfn version 1.0.5 Description: A Regular Expression Denial of Service ReDOS issue was found in the validation of crafted invalid emails. Recommendations: For regexfn version 1.0.5, consider updating to a newer version that addresses this...

PT-2022-14193 · WordPress · Active Products Tables For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Active Products Tables for WooCommerce plugin versions prior to 1.0.5 Description: The issue concerns a Reflected cross-Site Scripting problem. It arises because a parameter is not properly sanitised and escaped before being outputted in...

regexfn 安全漏洞

regexfn is a function that can be used for generic RegEx validation. regexfn version v1.0.5 contains a denial of service vulnerability that stems from not doing the right thing when validating crafted invalid emails, which could be exploited by an attacker to cause an application denial of servic...

miniOrange Google Authenticator < 1.0.5 - CSRF to Stored Cross-Site Scripting

The plugin does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform Cross-Site Scripting attacks v ' / v...

CVE-2021-45783

Bookeen Notea Firmware BKR1.0.520210608 is affected by a directory traversal vulnerability that allows an attacker to obtain sensitive information...

PT-2022-18169 · Arris · Sbr-Ac1900P +2

Name of the Vulnerable Software and Affected Versions: Arris routers SBR-AC1900P version 1.0.7-B05 Arris routers SBR-AC3200P version 1.0.7-B05 Arris routers SBR-AC1200P version 1.0.5-B05 Description: A command injection issue was discovered in the pppoe function, allowing attackers to execute...