CVE-2021-37540

In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used...

Security feature bypass

In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used...

CVE-2021-37540

In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used...

CVE-2021-37540

In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used...

CVE-2021-37540

CVE-2021-37540 affects JetBrains Hub prior to 2021.1.13262, where the Widget deployment feature used a potentially insufficient CSP. Multiple sources (Red Hat, CNVD, PRION/PT-Security, NVD/NVD list) confirm the issue name and affected version range. The JetBrains Security Bulletin Q2-2021 notes t...

PT-2021-21699 · Jetbrains · Jetbrains Hub

Name of the Vulnerable Software and Affected Versions: JetBrains Hub versions prior to 2021.1.13262 Description: The issue is related to a potentially insufficient Content Security Policy CSP used in the Widget deployment feature. This could lead to security risks, although specific details about...

JetBrains Hub 加密问题漏洞

JetBrains Hub is a web-based application from JetBrains Czech Republic. The application is capable of integrating multiple JetBrains team tools together. An encryption issue vulnerability exists in versions prior to JetBrains Hub 2021.1.13262, which stems from the fact that the CSP used by the...

CVE-2021-37540: Undefined Security Weakness

In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used...

WordPress Awesome Weather Widget plugin cross-site scripting vulnerability

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Awesome Weather Widget plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in...

CVE-2021-24474

The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesomeweatherrefresh AJAX action, leading to an unauthenticated Reflected Cross-Site Scripting XSS Vulnerability...

CVE-2021-24474

The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesomeweatherrefresh AJAX action, leading to an unauthenticated Reflected Cross-Site Scripting XSS Vulnerability...

CVE-2021-24443

The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the...

CVE-2021-24474

CVE-2021-24474 affects the WordPress plugin Awesome Weather Widget (

CVE-2021-24474 Awesome Weather Widget <= 3.0.2 - Reflected Cross-site Scripting (XSS)

The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesomeweatherrefresh AJAX action, leading to an unauthenticated Reflected Cross-Site Scripting XSS Vulnerability...

PT-2021-15998

Name of the Vulnerable Software and Affected Versions Awesome Weather Widget WordPress plugin versions prior to 3.0.3 Description The issue is related to an unauthenticated Reflected Cross-Site Scripting XSS vulnerability. It occurs because the id parameter of the awesome weather refresh AJAX...

CVE-2021-24474: Improper Neutralization of Input During Web Page Generation

The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesomeweatherrefresh AJAX action, leading to an unauthenticated Reflected Cross-Site Scripting XSS Vulnerability...

CVE-2021-24443: Improper Neutralization of Input During Web Page Generation

The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Awesome Weather Widget plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in...

WordPress Alojapro Widget plugin <= 1.1.15 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by xiahao in WordPress Alojapro Widget plugin versions = 1.1.15. Solution Update the WordPress Alojapro Widget plugin to the latest available version at least 1.1.16...

Alojapro Widget < 1.1.16 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following code in the Custom CSS settings of the plugin setTimeout"alert'1'",3000...