PT-2023-18766 · Unknown · Librephotos

Name of the Vulnerable Software and Affected Versions: LibrePhotos versions prior to e19e539 Description: The issue is related to incorrect access control in the api/views/user.py file. This could potentially allow unauthorized access to certain features or data. Recommendations: For versions pri...

WordPress Page View Count Plugin < 2.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Page View Count Type Plugin Vulnerable versions 2.6.1 Fixed in 2.6.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0095 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 545a0fccfa3b Credits Lana Codes Required...

Page View Count < 2.6.1 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Exploit Additional CSS classes for "Page Views"...

EulerOS Virtualization 2.9.1 : net-snmp (EulerOS-SA-2023-1198)

According to the versions of the net-snmp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in net-snmp. A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds...

Nextcloud Talk 访问控制错误漏洞

Nextcloud Talk is a self-hosted local audio/video and chat communication service from Nextcloud Germany. An access control error vulnerability exists in Nextcloud Talk. An attacker could use this vulnerability to access a user's Nextcloud files and view conversations...

NView SQL注入漏洞

NView is a php class for natural view management. NView suffers from a SQL injection vulnerability that stems from a problem with the function mutate in the file src/Session.php, where manipulation of the parameter session can lead to sql injection...

CVE-2023-22464 ViewVC XSS vulnerability in revision view changed path "copyfrom" locations

ViewVC is a browser interface for CVS and Subversion version control repositories. Versions prior to 1.2.3 and 1.1.30 are vulnerable to cross-site scripting. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a Subversion repository exposed by a...

devel/viewvc-devel is vulnerable to cross-site scripting

C. Michael Pilato reports: security fix: escape revision view copy paths 311 CVE-2023-22464 security fix: escape revision view changed paths 311 CVE-2023-22456...

CVE-2023-22456 ViewVC XSS vulnerability in revision view changed paths

ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versions prior to 1.2.2 and 1.1.29. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a Subversion repository...

Information Disclosure

github.com/usememos/memos is vulnerable to information disclosure. An attacker is able to make a private memo into a public memo in order to view it using the memo ID via making a PATCH request to /api/memo/ and view the memo data of the victim...

PT-2023-10104 · Unknown · Stiiv Contact App

Name of the Vulnerable Software and Affected Versions: stiiv contact app affected versions not specified Description: A vulnerability has been found in stiiv contact app and classified as problematic. The function render of the file libs/View.php is affected by this issue. The manipulation of the...

Vulnerability fixed in Esri ArcGIS Server

A vulnerability has been fixed in Esri ArcGis Server. This vulnerability allows an unauthenticated malicious person through path traversal to view system information from the server on which the application is running. Esri has released updates to fix the vulnerability. For more information, see:...

Snipe-IT vulnerable to Cross Site Scripting for View Assigned Assets

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

GHSA-363Q-J92X-7543 Snipe-IT vulnerable to Cross Site Scripting for View Assigned Assets

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

CVE-2022-44380

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

Cross site scripting

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

CVE-2022-44380

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

CVE-2022-44380

Snipe-IT prior to version 6.0.14 is affected by a Cross Site Scripting (XSS) vulnerability when viewing assigned assets. The issue is documented across multiple feeds (CVE-2022-44380) and is addressed by upgrading to Snipe-IT 6.0.14 or later, per Red Hat advisory and NCSC release notes indicating...

CVE-2022-44380

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

PT-2022-7106 · Ibm · Ibm Navigator For I

Name of the Vulnerable Software and Affected Versions: IBM Navigator for i versions 7.3 through 7.5 Description: The issue is related to the lack of protection for the SQL query structure in the IBM Navigator graphical interface of the IBM i operating system. This could allow a remote attacker to...