Security feature bypass

In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used...

CVE-2021-37540

In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used...

CVE-2021-37540

In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used...

CVE-2021-37540

CVE-2021-37540 affects JetBrains Hub prior to 2021.1.13262, where the Widget deployment feature used a potentially insufficient CSP. Multiple sources (Red Hat, CNVD, PRION/PT-Security, NVD/NVD list) confirm the issue name and affected version range. The JetBrains Security Bulletin Q2-2021 notes t...

JetBrains Hub 加密问题漏洞

JetBrains Hub is a web-based application from JetBrains Czech Republic. The application is capable of integrating multiple JetBrains team tools together. An encryption issue vulnerability exists in versions prior to JetBrains Hub 2021.1.13262, which stems from the fact that the CSP used by the...

PT-2021-21699 · Jetbrains · Jetbrains Hub

Name of the Vulnerable Software and Affected Versions: JetBrains Hub versions prior to 2021.1.13262 Description: The issue is related to a potentially insufficient Content Security Policy CSP used in the Widget deployment feature. This could lead to security risks, although specific details about...

WordPress Awesome Weather Widget plugin cross-site scripting vulnerability

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Awesome Weather Widget plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in...

CVE-2021-24474

The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesomeweatherrefresh AJAX action, leading to an unauthenticated Reflected Cross-Site Scripting XSS Vulnerability...

CVE-2021-24474

The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesomeweatherrefresh AJAX action, leading to an unauthenticated Reflected Cross-Site Scripting XSS Vulnerability...

CVE-2021-24443

The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the...

CVE-2021-24474

CVE-2021-24474 affects the WordPress plugin Awesome Weather Widget (

CVE-2021-24474 Awesome Weather Widget <= 3.0.2 - Reflected Cross-site Scripting (XSS)

The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesomeweatherrefresh AJAX action, leading to an unauthenticated Reflected Cross-Site Scripting XSS Vulnerability...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Awesome Weather Widget plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in...

WordPress Alojapro Widget plugin <= 1.1.15 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by xiahao in WordPress Alojapro Widget plugin versions = 1.1.15. Solution Update the WordPress Alojapro Widget plugin to the latest available version at least 1.1.16...

Alojapro Widget < 1.1.16 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following code in the Custom CSS settings of the plugin setTimeout"alert'1'",3000...

Alojapro Widget < 1.1.16 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Put the following code in the Custom CSS settings of the plugin setTimeout"alert'1'",3000...

WordPress Popular Posts 5.3.2 Plugin - Remote Code Execution (Authenticated) Exploit

Exploit Title: WordPress Plugin Popular Posts 5.3.2 - Remote Code Execution RCE Authenticated Exploit Author: Simone Cristofaro Vendor Homepage: https://it.wordpress.org/plugins/wordpress-popular-posts/ Software Link: https://downloads.wordpress.org/plugin/wordpress-popular-posts.5.3.2.zip Versio...

Cross-site Scripting (XSS)

Overview smashing is an a framework for pulling together an overview of data that is important to your team and displaying it easily on TVs around the office. Affected versions of this package are vulnerable to Cross-site Scripting XSS. A URL for a widget can be crafted and used to execute...

CVE-2021-35440

Smashing 1.3.4 is vulnerable to Cross Site Scripting XSS. A URL for a widget can be crafted and used to execute JavaScript on the victim's computer. The JavaScript code can then steal data available in the session/cookies depending on the user environment e.g. if re-using internal URL's for...

CVE-2021-35440

Smashing 1.3.4 is vulnerable to Cross Site Scripting XSS. A URL for a widget can be crafted and used to execute JavaScript on the victim's computer. The JavaScript code can then steal data available in the session/cookies depending on the user environment e.g. if re-using internal URL's for...