PYSEC-2024-234

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

PYSEC-2024-234

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-23807

The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD processing. This can be accomplished via...

Avo Cross-Site Scripting Vulnerability

Avo is Avo open source an open source ruby on rails admin panel creation framework. A cross-site scripting vulnerability exists in Avo version v3.2.3, which stems from a stored cross-site scripting XSS vulnerability in the keyvalue field...

WordPress WP Courses LMS Plugin <= 3.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Courses LMS Type Plugin Vulnerable versions = 3.2.3 Fixed in 3.2.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 884d6eecec59 Credits Unknown Required privilege...

CVE-2023-43340

Cross-site scripting XSS vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword and cmspasswordconfim parameters...

PT-2023-28789 · Evolution · Evolution

Name of the Vulnerable Software and Affected Versions: evolution version 3.2.3 Description: A cross-site scripting XSS issue allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword, and cmspasswordconfim parameters. This enabl...

Evolution CMS Cross-Site Scripting Vulnerability

Evolution CMS is an open source PHP-based content management system CMS. A security vulnerability exists in Evolution CMS version v.3.2.3, which stems from a cross-site scripting XSS vulnerability in several parameters such as cmsadmin, cmsadminmail, and others...

PT-2023-6251 · Apache +6 · Xerces-C++ +6

Name of the Vulnerable Software and Affected Versions: xerces-c++ version 3.2.3 Description: The issue is caused by an integer overflow in xerces-c++ that allows remote attackers to cause out-of-bound access via an HTTP request. This can potentially allow a remote attacker to execute arbitrary co...

WordPress SSL Mixed Content Fix Plugin <= 3.2.3 is vulnerable to Broken Access Control

Software SSL Mixed Content Fix Type Plugin Vulnerable versions = 3.2.3 Fixed in 3.2.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0958 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f6d89bad3ca9 Credits WordFence Required...

WordPress plugin Membership Plugin - Restrict Content 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Debian DSA-5432-1 : xmltooling - security update

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5432 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The...

PT-2023-19526 · WordPress · Nested Pages

Name of the Vulnerable Software and Affected Versions: Nested Pages plugin for WordPress versions up to, and including, 3.2.3 Description: The issue is related to a missing capability check on the reset function, which allows authenticated attackers with editor-level permissions and above to rese...

FunAdmin 跨站脚本漏洞

FunAdmin is FunAdmin open source based on ThinkPHP6+Layui development of a lightweight high-profile backend development system . FunAdmin version 3.2.3 and previous versions of cross-site scripting vulnerability , the vulnerability stems from the wrong operation of the parameter file leads to...

CVE-2023-0486

VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance's administrator account via a malicious link. This is possible because the application is vulnerable to XSS...

Cross site scripting

VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance's administrator account via a malicious link. This is possible because the application is vulnerable to XSS...

PT-2023-16293 · Vitalpbx · Vitalpbx

Name of the Vulnerable Software and Affected Versions: VitalPBX version 3.2.3-8 Description: The issue allows an unauthenticated external attacker to obtain the instance administrator's account due to the application being vulnerable to CSRF. Recommendations: For VitalPBX version 3.2.3-8, update ...

VitalPBX 跨站请求伪造漏洞

VitalPBX is an Asterisk-based unified communications PBX system. A security vulnerability exists in VitalPBX version 3.2.3-8 that stems from the program's susceptibility to CSRF attacks, which can be exploited by an attacker to gain access to an instance administrator's account...

PT-2023-16298 · Vitalpbx · Vitalpbx

Name of the Vulnerable Software and Affected Versions: VitalPBX version 3.2.3-8 Description: The issue allows an unauthenticated external attacker to obtain the instance's administrator account via a malicious link. This is possible because the application is vulnerable to cross-site scripting XS...

WordPress Plugin Booking calendar, Appointment Booking System 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...