111 matches found
CVE-2023-32671
A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9. This vulnerability allows an attacker to store a malicious javascript payload via POST request when sending an invitation...
Cross site scripting
A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9. This vulnerability allows an attacker to store a malicious javascript payload via POST request when sending an invitation...
CVE-2023-32671 BuddyBoss XSS vulnerability
A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9. This vulnerability allows an attacker to store a malicious javascript payload via POST request when sending an invitation...
CVE-2023-32671
The CVE-2023-32671 entry describes a stored XSS vulnerability in BuddyBoss Platform (version 2.2.9). The flaw allows an attacker to store a malicious JavaScript payload via a POST request when sending an invitation. Public documents confirm this as a stored XSS issue affecting BuddyBoss Platform ...
CVE-2023-32671 BuddyBoss XSS vulnerability
A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9. This vulnerability allows an attacker to store a malicious javascript payload via POST request when sending an invitation...
CVE-2023-32669 Authorization Bypass on BuddyBoss
Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' albums. This vulnerability can be exploited by changing the album identification id...
BuddyBoss Security Breach
BuddyBoss Platform is a state-of-the-art plugin from BuddyBoss for running online communities on WordPress. A security vulnerability exists in version 2.2.9 of BuddyBoss that stems from allowing authenticated users to access and rename other users' photo albums...
BuddyBoss Cross-Site Scripting Vulnerability
BuddyBoss Platform is a state-of-the-art plugin from BuddyBoss for running online communities on WordPress. A cross-site scripting vulnerability exists in BuddyBoss version 2.2.9 that originates from allowing a local attacker to execute a malicious payload via the name=image.jpg parameter...
CVE-2023-32296
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Kangu para WooCommerce plugin = 2.2.9 versions...
WordPress WooDiscuz – WooCommerce Comments Plugin <= 2.2.9 is vulnerable to Cross Site Scripting (XSS)
Software WooDiscuz – WooCommerce Comments Type Plugin Vulnerable versions = 2.2.9 Fixed in 2.3.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-33216 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 32824c56ebab Credits Emili...
Debian: Security Advisory (DSA-5348-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE CVE-2005-3570
Unspecified cross-site scripting XSS vulnerability in Horde before 2.2.9 allows remote attackers to inject arbitrary web script or HTML via "not properly escaped error messages"...
[SECURITY] [DSA 5348-1] haproxy security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5348-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 14, 2023 https://www.debian.org/security/faq -...
UReport 路径遍历漏洞
UReport is a high-performance pure Java reporting engine based on the Spring architecture that prepares complex Chinese reports and statements by iterating over cells. A security vulnerability exists in UReport version v2.2.9, which stems from an arbitrary file deletion vulnerability...
Blink1Control2 uses weak password encryption
The Blink1Control2 application = 2.2.7 uses weak password encryption and an insecure method of storage. Version 2.2.9 fixes the issue...
Magento 2 Community Edition CSRF vulnerability
A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...
Magento 2 Community Edition XSS Vulnerability
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...
Cross site request forgery (csrf)
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 and prior to versions 2.1.15, 2.2.9, and 2.3.4 which would allow unauthenticated users to impersonate as any Argo CD user or role, includin...
CVE-2022-0601
The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...
WordPress Countdown & Clock plugin <= 2.2.8 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Countdown & Clock plugin versions = 2.2.8. Solution Update the WordPress Countdown & Clock plugin to the latest available version at least 2.2.9...