8950 matches found
EqualWeb Accessibility Widget 跨站脚本漏洞
The EqualWeb Accessibility Widget is an accessibility widget from EqualWeb. A security vulnerability exists in the EqualWeb Accessibility Widget, which stems from an incorrect validation of message events in its accessibility.js component that could allow an attacker to implement DOM-based...
CVE-2022-42960
EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js...
CVE-2022-42960
EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js...
CVE-2022-42960
CVE-2022-42960 concerns the EqualWeb Accessibility Widget. The connected sources confirm a DOM XSS vulnerability in the widget due to improper validation of message events within accessibility.js. Affected versions include 2.0.0 through 4.0.1 (exact sub-versions listed in the public records). The...
CVE-2022-42960: Improper Neutralization of Input During Web Page Generation
EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js...
PT-2022-26681
Name of the Vulnerable Software and Affected Versions EqualWeb Accessibility Widget versions 2.0.0 through 4.0.1 Description The issue is related to DOM XSS due to improper validation of message events to accessibility.js. This allows for potential exploitation. Recommendations For versions 2.0.0...
Malicious code in nab-chat-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3282e7d700011745064925e0748cac1ec1b476b97086e633a6c18a9fcc04bf2a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-4779 Malicious code in nab-chat-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3282e7d700011745064925e0748cac1ec1b476b97086e633a6c18a9fcc04bf2a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
WordPress Countdown Widget < 3.1.9.3 - Admin+ Stored XSS
The plugin does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
New Vulnerability in Popular Widget Shows Risks of Third-Party Code
UPDATE: Snyk has recently addressed 2 additional vulnerabilities we have reported to them, CVE-2022-24441 and CVE-2022-22984, affecting versions of Snyk CLI before XXX, which leads to arbitrary code execution when scanning untrusted Maven or Gradle projects. Similar to CVE-2022-40764 these...
CVE-2022-32587
Cross-Site Request Forgery CSRF vulnerability in CodeAndMore WP Page Widget plugin = 3.9 on WordPress leading to plugin settings change...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in CodeAndMore WP Page Widget plugin = 3.9 on WordPress leading to plugin settings change...
CVE-2022-32587 WordPress WP Page Widget plugin <= 3.9 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in CodeAndMore WP Page Widget plugin = 3.9 on WordPress leading to plugin settings change...
CVE-2022-32587 WordPress WP Page Widget plugin <= 3.9 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in CodeAndMore WP Page Widget plugin = 3.9 on WordPress leading to plugin settings change...
CVE-2022-32587
Summary: CVE-2022-32587 affects the CodeAndMore WP Page Widget plugin for WordPress, specifically versions <= 3.9, due to a CSRF weakness that allows changes to plugin settings. Affected software: CodeAndMore WP Page Widget plugin (WordPress)
WordPress plugin WP Page Widget 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
CVE-2022-32587: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in CodeAndMore WP Page Widget plugin = 3.9 on WordPress leading to plugin settings change...
PT-2022-21388 · WordPress · Codeandmore Wp Page Widget
Name of the Vulnerable Software and Affected Versions: CodeAndMore WP Page Widget plugin versions prior to 3.9 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which can lead to changes in the plugin settings. Recommendations: For CodeAndMore WP Page Widget...
CVE-2022-42924
Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker with the role of student to perform a SQL injection on the 'dynfilter' parameter in the...
Sql injection
Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker with the role of student to perform a SQL injection on the 'dynfilter' parameter in the...