344 matches found
WordPress XO Slider plugin <= 3.3.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien Patchstack Alliance in WordPress XO Slider plugin versions = 3.3.2. Solution Update the WordPress XO Slider plugin to the latest available version at least 3.3.3...
XO Slider < 3.3.3 - Contributor+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its Slider fields, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...
Malicious code in xo-locale (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92f65da170cd5aedf78940cd84c218fe4d0f5319decff6a709c640a9b354e735 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-7288 Malicious code in xo-locale (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92f65da170cd5aedf78940cd84c218fe4d0f5319decff6a709c640a9b354e735 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
XO Event Calendar < 2.3.7 - Reflected Cross-Site Scripting
The plugin does not escape the selected-name parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/edit.php?posttype=xoevent=xo-event-holiday-settings&selected-name;="...
XO Event Calendar < 2.3.7 - Reflected Cross-Site Scripting
The plugin does not escape the selected-name parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/edit.php?posttype=xoevent&page=xo-event-holiday-settings&selected-name="alert/XSS/...
CVE-2021-36383: Undefined Security Weakness
Xen Orchestra with xo-web through 5.80.0 and xo-server through 5.84.0 mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit,...
PT-2021-21263
Name of the Vulnerable Software and Affected Versions Xen Orchestra versions through 5.80.0 xo-web and through 5.84.0 xo-server Description The issue concerns mishandled authorization. An attacker can modify WebSocket resourceSet.getAll data, changing the permission field from none to admin,...
@attraqt/activity (>=0.0.1, <=1.3.0), @attraqt/xo-js (0.0.1) +2 more potentially affected by CVE-2020-28464 via djv (2.1.3-alpha.0)
djv NPM version 2.1.3-alpha.0 is affected by a known vulnerability. The following packages have a transitive dependency on djv and may be impacted: - @attraqt/activity =0.0.1, =1.1.8, =1.0.3, =1.1.6 Source cves: CVE-2020-28464 Source advisory: OSV:GHSA-4HV7-3Q38-97M8...
@attraqt/activity (>=0.0.1, <=1.3.0), @attraqt/xo-js (0.0.1) +2 more potentially affected by CVE-2020-28464 via djv (2.1.3-alpha.0)
djv NPM version 2.1.3-alpha.0 is affected by a known vulnerability. The following packages have a transitive dependency on djv and may be impacted: - @attraqt/activity =0.0.1, =1.1.8, =1.0.3, =1.1.6 Source cves: CVE-2020-28464 Source advisory: SNYK:JS-DJV-1014545...
NeDi Consulting NeDi Cross-Site Scripting Vulnerability (CNVD-2020-44575)
NeDi Consulting NeDi is a suite of open source software that supports discovery and mapping of network devices from the Swiss company NeDi Consulting. A cross-site scripting vulnerability exists in NeDi Consulting NeDi version 1.9C. The vulnerability can be exploited to execute arbitrary JavaScri...
CVE-2020-15028: Improper Neutralization of Input During Web Page Generation
NeDi 1.9C is vulnerable to a cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Map.php xo parameter...
PT-2020-14129
Name of the Vulnerable Software and Affected Versions NeDi version 1.9C Description The issue allows an attacker to execute arbitrary JavaScript code via the "Topology-Map.php" xo parameter, enabling a cross-site scripting XSS attack. Recommendations For NeDi version 1.9C, consider disabling acce...
WordPress xo-security plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. xo-security is a plugin used to enhance login-related security. A cross-site scripting vulnerability exists in the WordPress xo-securi...
CVE-2017-18541
The xo-security plugin before 1.5.3 for WordPress has XSS...
CVE-2017-18541
The xo-security plugin before 1.5.3 for WordPress has XSS...
Cross site scripting
The xo-security plugin before 1.5.3 for WordPress has XSS...
CVE-2017-18541
The xo-security plugin before 1.5.3 for WordPress has XSS...
CVE-2017-18541
The CVE-2017-18541 entry concerns the WordPress plugin XO Security, specifically versions before 1.5.3, which contain a cross-site scripting (XSS) flaw. Several connected sources (Red Hat, CNVD, NVD, CVE records, and WPvulndb) corroborate that the vulnerability is an XSS in the XO Security WordPr...