CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-51819 – WordPress Tigris Flexplatform plugin <=1.0.2 - Stored Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-51819
08 Nov 2024 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tigris – Flexplatform Tigris Flexplatform allows Stored XSS.This issue affects Tigris Flexplatform: from n/a through .0.2. The Tigris Flexplatform plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to i... • https://patchstack.com/database/vulnerability/tigris-flexplatform/wordpress-tigris-flexplatform-plugin-1-0-2-stored-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 3%CPEs: 8EXPL: 3CVE-2024-31497 – Gentoo Linux Security Advisory 202407-11
https://notcve.org/view.php?id=CVE-2024-31497
15 Apr 2024 — In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is especially important in a scenario where an adversary is able to read messages signed by PuTTY or Pageant. The required set of signed messages may be publicly readable because they are stored in a public Git service that supports use of SSH for commit signing, and the signatures were made by Pageant through an agent-forw... • https://github.com/sh1k4ku/CVE-2024-31497 • CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) •
CVSS: 9.3EPSS: 2%CPEs: 99EXPL: 0CVE-2010-3199
https://notcve.org/view.php?id=CVE-2010-3199
10 Sep 2010 — Untrusted search path vulnerability in TortoiseSVN 1.6.10, Build 19898 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a file that is processed by Tortoise. NOTE: this is only a vulnerability when a file extension is associated with TortoiseProc or TortoiseMerge, which is not the default. Vulnerabilidad ruta de búsqueda no confiable en TortoiseSVN v1.6.10, Build 1989... • http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=2653163 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2009-0240
https://notcve.org/view.php?id=CVE-2009-0240
21 Jan 2009 — listing.php in WebSVN 2.0 and possibly 1.7 beta, when using an SVN authz file, allows remote authenticated users to read changelogs or diffs for restricted projects via a modified repname parameter. listing.php en WebSVN 2.0 y posiblemente 1.7 beta, cuando utilizan un fichero SVN authz, permite a usuarios autenticados remotamente leer changelogs o diffs para proyectos restringidos a través del parámetro modificado "repname". • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512191 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 8%CPEs: 20EXPL: 3CVE-2008-5918 – WebSVN 2.0 - Cross-Site Scripting / File Handling / Code Execution
https://notcve.org/view.php?id=CVE-2008-5918
21 Jan 2009 — Cross-site scripting (XSS) vulnerability in the getParameterisedSelfUrl function in index.php in WebSVN 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la función getParameterisedSelfUrl en index.php en WebSVN v2.0 y anteriores permite a atacantes remotos inyectar secuencias de comando web o HTML de su elección a través de PATH_INFO. • https://www.exploit-db.com/exploits/6822 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 6%CPEs: 20EXPL: 3CVE-2008-5919 – WebSVN 2.0 - Cross-Site Scripting / File Handling / Code Execution
https://notcve.org/view.php?id=CVE-2008-5919
21 Jan 2009 — Directory traversal vulnerability in rss.php in WebSVN 2.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to overwrite arbitrary files via directory traversal sequences in the rev parameter. Vulnerabilidad de salto de directorio en rss.php en WebSVN v2.0 y anteriores, cuando magic_quotes_gpc está deshabilitado, permite a atacantes remotos sobrescribir ficheros de su elección a través de secuencias de salto de directorio en el parámetro "rev". • https://www.exploit-db.com/exploits/6822 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 1%CPEs: 19EXPL: 2CVE-2008-5920 – WebSVN 2.0 - Cross-Site Scripting / File Handling / Code Execution
https://notcve.org/view.php?id=CVE-2008-5920
21 Jan 2009 — The create_anchors function in utils.inc in WebSVN 1.x allows remote attackers to execute arbitrary PHP code via a crafted username that is processed by the preg_replace function with the eval switch. La función create_anchors en utils.inc en WebSVN v1.x permite a atacantes remotos ejecutar código PHP de su elección a través de nombres de usuario manipulados que es procesado por la función preg_replace con el switch "eval". • https://www.exploit-db.com/exploits/6822 • CWE-94: Improper Control of Generation of Code ('Code Injection') •