7151 matches found
EqualWeb Accessibility Widget 跨站脚本漏洞
The EqualWeb Accessibility Widget is an accessibility widget from EqualWeb. A security vulnerability exists in the EqualWeb Accessibility Widget, which stems from an incorrect validation of message events in its accessibility.js component that could allow an attacker to implement DOM-based...
MAL-2022-4779 Malicious code in nab-chat-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3282e7d700011745064925e0748cac1ec1b476b97086e633a6c18a9fcc04bf2a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in nab-chat-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3282e7d700011745064925e0748cac1ec1b476b97086e633a6c18a9fcc04bf2a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
WordPress Countdown Widget < 3.1.9.3 - Admin+ Stored XSS
The plugin does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
New Vulnerability in Popular Widget Shows Risks of Third-Party Code
UPDATE: Snyk has recently addressed 2 additional vulnerabilities we have reported to them, CVE-2022-24441 and CVE-2022-22984, affecting versions of Snyk CLI before XXX, which leads to arbitrary code execution when scanning untrusted Maven or Gradle projects. Similar to CVE-2022-40764 these...
CVE-2022-32587
Cross-Site Request Forgery CSRF vulnerability in CodeAndMore WP Page Widget plugin = 3.9 on WordPress leading to plugin settings change...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in CodeAndMore WP Page Widget plugin = 3.9 on WordPress leading to plugin settings change...
CVE-2022-32587 WordPress WP Page Widget plugin <= 3.9 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in CodeAndMore WP Page Widget plugin = 3.9 on WordPress leading to plugin settings change...
CVE-2022-32587
Summary: CVE-2022-32587 affects the CodeAndMore WP Page Widget plugin for WordPress, specifically versions <= 3.9, due to a CSRF weakness that allows changes to plugin settings. Affected software: CodeAndMore WP Page Widget plugin (WordPress)
CVE-2022-32587 WordPress WP Page Widget plugin <= 3.9 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in CodeAndMore WP Page Widget plugin = 3.9 on WordPress leading to plugin settings change...
WordPress plugin WP Page Widget 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2022-21388 · WordPress · Codeandmore Wp Page Widget
Name of the Vulnerable Software and Affected Versions: CodeAndMore WP Page Widget plugin versions prior to 3.9 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which can lead to changes in the plugin settings. Recommendations: For CodeAndMore WP Page Widget...
CVE-2022-42924
Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker with the role of student to perform a SQL injection on the 'dynfilter' parameter in the...
Sql injection
Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker with the role of student to perform a SQL injection on the 'dynfilter' parameter in the...
WordPress plugin Rock Convert 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
WordPress 5.3.x < 5.3.14 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS via wp-mail.php post by email. - An open redirect in wpnonceays. - Sender's email address is exposed in wp-mail.php. - A Cross-Site...
WordPress 5.8.x < 5.8.6 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS via wp-mail.php post by email. - An open redirect in wpnonceays. - Sender's email address is exposed in wp-mail.php. - A Cross-Site...
WordPress 4.5.x < 4.5.28 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS via wp-mail.php post by email. - An open redirect in wpnonceays. - Sender's email address is exposed in wp-mail.php. - A Cross-Site...
Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module
A Cross-site scripting XSS vulnerability in the Portal Search module's Sort widget before 6.0.45 from Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via...
CVE-2022-42112
A Cross-site scripting XSS vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted paylo...