155 matches found
CVE-2025-0424
In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple authenticated stored cross-site scripting vulnerabilities. An authenticated attacker is able to compromise the sessions of other users on the server by injecting JavaScript code into their...
CVE-2025-0424 Multiple Authenticated Stored Cross-Site Scripting
In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple authenticated stored cross-site scripting vulnerabilities. An authenticated attacker is able to compromise the sessions of other users on the server by injecting JavaScript code into their...
libafl_qemu (>=0.10.0 <=0.10.1), libafl_sugar (>=0.10.0 <=0.11.0) +2 more potentially affected by unknown CVE via libafl (>=0.10.1 <=0.11.0)
libafl CARGO version =0.10.1, =0.10.0, =0.10.0, =0.10.0, =0.10.0, =0.10.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0424...
Photon OS 3.0: Libvirt PHSA-2022-3.0-0424
An update of the libvirt package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2022-3.0-0424. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
RHEL 8 : rpm (RHSA-2024:0424)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0424 advisory. The RPM Package Manager RPM is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and...
RHSA-2024:0424
creationtimestamp| type| source ---|---|--- 2024-01-24 17:17:01+00:00| seen| https://t.me/ctinow/172931...
CVE-2024-0424 CodeAstro Simple Banking System Create a User Page createuser.php cross site scripting
A vulnerability classified as problematic has been found in CodeAstro Simple Banking System 1.0. This affects an unknown part of the file createuser.php of the component Create a User Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit...
CVE-2023-0424
creationtimestamp| type| source ---|---|--- 2023-04-24 22:19:28+00:00| seen| https://t.me/cibsecurity/62739 2025-02-06 02:42:28+00:00| seen| Telegram/N1pLjKXKwQr-YINTXfStpPyEsU3FjPrblxgOfc9uX-xM2i...
CVE-2023-0424
The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks...
CVE-2023-0424 MS-Reviews <= 1.5 - Subscriber+ Stored XSS
The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks...
WordPress MS-Reviews Plugin <= 1.5 is vulnerable to Cross Site Scripting (XSS)
Software MS-Reviews Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0424 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 3c9df93ac5de Credits Rio Darmawan Required privilege...
Mageia: Security Advisory (MGASA-2022-0424)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Security Bulletin: IBM Smart Analytics System 5600 is affected by vulnerabilities in the IBM Java SDK
Abstract The IBM Smart Analytics System 5600 contains a management host that is installed with the Mozilla Firefox browser. The browser is configured to use IBM Java SDK for Java Web Start applications. The browser software is configured in this manner to allow the use of the Remote Control...
CVE-2022-0424
creationtimestamp| type| source ---|---|--- 2022-05-09 20:36:44+00:00| seen| https://t.me/cibsecurity/42194...
CVE-2022-0424
The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users...
CVE-2022-0424 Popup by Supsystic < 1.10.9 - Unauthenticated Subscriber Email Addresses Disclosure
The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users...
CVE-2022-0424
The CVE-2022-0424 issue affects the Popup by Supsystic WordPress plugin, specifically versions prior to 1.10.9. The root cause is missing authentication/authorization in an AJAX action, permitting unauthenticated attackers to invoke the endpoint and retrieve the email addresses of subscribed user...
Mageia: Security Advisory (MGASA-2014-0424)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Mageia: Security Advisory (MGASA-2020-0424)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...