760 matches found
Design/Logic Flaw
The Admin Classic Bundle provides a Backend UI for Pimcore. AdminBundle\Security\PimcoreUserTwoFactorCondition introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor...
Improper Validation of Syntactic Correctness of Input
Overview Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse function. An attacker can cause a panic by providing crafted input causing a "runtime error: slice bounds out of range". PoC go import "fmt"...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Themeisle Cloud_Templates_\&_Patterns_Collection
CVE-2023-47529 Cloud Templates & Patterns collection =...
PT-2023-6888 · WordPress · Wp Fastest Cache
Name of the Vulnerable Software and Affected Versions: WP Fastest Cache versions prior to 1.2.2 Description: The issue is related to the WP Fastest Cache WordPress plugin, which does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection...
CVE-2023-46642
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in sahumedia SAHU TikTok Pixel for E-Commerce plugin = 1.2.2 versions...
CVE-2023-47397
WeBid =1.2.2 is vulnerable to code injection via admin/categoriestrans.php...
WeBid security breach
WeBid is an open source auction site building solution. A security vulnerability exists in renlok WeBid 1.2.2 and earlier versions, which stems from an easy code injection attack via admin/categoriestrans.php...
PT-2023-30442 · Webid · Webid
Name of the Vulnerable Software and Affected Versions: WeBid versions 1.2.2 and earlier Description: The issue allows for code injection via the "admin/categoriestrans.php" endpoint. This could potentially lead to unauthorized access or control of the system. Recommendations: For WeBid versions...
exfatprogs Security Vulnerabilities
exfatprogs is exfatprogs open source an exFAT file system user space utility. A security vulnerability exists in exfatprogs versions prior to 1.2.2, which stems from an out-of-bounds memory access vulnerability in readfileentryset...
Google Sheets data source plugin for Grafana information disclosure vulnerability
Grafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable to an information disclosure vulnerability. The plugin did not properly sanitize error messages, making it potentially expose the Google...
WordPress plugin User Avatar cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
CVE-2022-22298
A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiIsolator version 1.0.0, FortiIsolator version 1.1.0, FortiIsolator version 1.2.0 through 1.2.2, FortiIsolator version 2.0.0 through 2.0.1, FortiIsolator version 2.1.0 through 2.1.2,...
WordPress User Avatar - Reloaded Plugin < 1.2.2 is vulnerable to Cross Site Scripting (XSS)
Software User Avatar - Reloaded Type Plugin Vulnerable versions 1.2.2 Fixed in 1.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4798 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a4fd94410ec4 Credits Dmitrii Ignatyev...
Google Sheets data source plugin - API key leaks in error messages
The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable to an information disclosure vulnerability. The plugin did not properly sanitize error messages, making it potentially expose the Google Sheet API-key that is configured for the data source. This vulnerabilit...
Malicious code in testingoli (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 195be366acb384abf4322d56ed3ac6985d510e4aea1a4c6157fd8a2fbd9c5bc0 The OpenSSF Package Analysis project identified 'testingoli' @ 1.2.2 npm as malicious. It is considered malicious because: - The package...
WordPress plugin Audio Player with Playlist Ultimate Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...
CVE-2023-2279
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'adminpagedisplay' function. This makes it possible for unauthenticated attackers to delete or change plugin...
CVE-2023-2279
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'adminpagedisplay' function. This makes it possible for unauthenticated attackers to delete or change plugin...