PT-2024-36648 · 搜狐畅言 · 搜狐畅言

Name of the Vulnerable Software and Affected Versions: 搜狐畅言 畅言评论系统 versions n/a through 2.0.5 Description: The issue is related to a missing authorization vulnerability that allows the exploitation of incorrectly configured access control security levels. Recommendations: For versions n/a through...

CVE-2024-9822

The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'loginadminuser' function. This makes it possible for unauthenticated attackers to log to the first user, who is usually the...

WordPress Pedalo Connector plugin <= 2.0.5 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by István Márton in WordPress Plugin Pedalo Connector versions = 2.0.5...

CVE-2024-39310 WordPress Basil Theme Authenticated (Contributor+) Persistent Cross-Site Scripting Vulnerability

The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting XSS via the posttitle parameter in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access...

CVE-2024-5646

The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘headersize’ attribute within the Advanced Text Block widget in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress Futurio Extra Plugin <= 2.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Futurio Extra Type Plugin Vulnerable versions = 2.0.5 Fixed in 2.0.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5646 Patch priority Low CVSS severity Low 6.5 Developer FuturioWP PSID ebce01258690 Credits wesley wcraft Required privilege...

PT-2024-36819 · WordPress · Futurio Extra

Name of the Vulnerable Software and Affected Versions: Futurio Extra plugin for WordPress versions up to, and including, 2.0.5 Description: The issue is related to Stored Cross-Site Scripting via the header size attribute within the Advanced Text Block widget due to insufficient input sanitizatio...

PT-2024-9746

Name of the Vulnerable Software and Affected Versions Synology Media Server versions prior to 1.4-2680 Synology Media Server versions prior to 2.0.5-3152 Synology Media Server versions prior to 2.2.0-3325 Description The issue is related to an authorization bypass vulnerability through a...

PT-2024-11727 · Unknown · Wp-Formassembly

Name of the Vulnerable Software and Affected Versions: WP-FormAssembly versions n/a through 2.0.5 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This vulnerability allows Path Traversal in...

WordPress plugin WP-FormAssembly 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

WordPress Plugin Getwid 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exis...

BIT-HARBOR-2020-29662

In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path...

CVE-2024-23513

Deserialization of Untrusted Data vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.5...

PT-2024-12648 · Fronius · Fronius Datalogger Web

Name of the Vulnerable Software and Affected Versions: Fronius Datalogger Web version 2.0.5-4 Description: An issue in the software allows remote attackers to obtain sensitive information via a crafted request. Recommendations: For version 2.0.5-4, at the moment, there is no information about a...

Cross-site Scripting potential in custom links, job buttons, and computed fields

Impact All users of Nautobot versions earlier than 1.6.6 or 2.0.5 are potentially affected. Due to incorrect usage of Django's marksafe API when rendering certain types of user-authored content, including: - custom links - job buttons - computed fields it is possible that users with permission to...

Cross site scripting

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application All users of Nautobot versions earlier than 1.6.6 or 2.0.5 are potentially affected by a cross-site scripting vulnerability. Due to incorrect usage of Django's marksafe API when rendering certain type...

WordPress Plugin WordPress File Sharing Plugin Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

Information disclosure

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak...

PYSEC-2023-192

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak...

CVE-2023-43804 `Cookie` HTTP header isn't stripped on cross-origin redirects

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak...