CVE-2024-32441

Cross-Site Request Forgery CSRF vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.7...

PT-2024-24573 · Zoho · Zoho Campaigns

Name of the Vulnerable Software and Affected Versions: Zoho Campaigns versions n/a through 2.0.7 Description: A Cross-Site Request Forgery CSRF issue has been identified. This issue allows an attacker to trick a user into performing unintended actions on a web application. Recommendations: For...

PT-2024-24572 · Zoho · Zoho Campaigns

Name of the Vulnerable Software and Affected Versions: Zoho Campaigns versions n/a through 2.0.7 Description: A Cross-Site Request Forgery CSRF issue has been identified. This issue allows an attacker to trick a user into performing unintended actions on a web application that the user is...

WordPress Zoho Campaigns Plugin <= 2.0.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Zoho Campaigns Type Plugin Vulnerable versions = 2.0.7 Fixed in 2.0.8 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-32441 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0193281fc692 Credits Majed Refaea Required...

CVE-2024-1812 Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the 'fonturl' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and ca...

UBUNTU-CVE-2024-28176

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens JWT, JSON Web Signature JWS, JSON Web Encryption JWE, JSON Web Key JWK, JSON Web Key Set JWKS, and more. A vulnerability has been identified in the JSON Web Encryption JWE decryption interfaces...

CVE-2024-28176 jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens JWT, JSON Web Signature JWS, JSON Web Encryption JWE, JSON Web Key JWK, JSON Web Key Set JWKS, and more. A vulnerability has been identified in the JSON Web Encryption JWE decryption interfaces...

CVE-2024-28176 jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens JWT, JSON Web Signature JWS, JSON Web Encryption JWE, JSON Web Key JWK, JSON Web Key Set JWKS, and more. A vulnerability has been identified in the JSON Web Encryption JWE decryption interfaces...

CVE-2024-28176

Observed : CVE-2024-28176 affects the jose library (JWE) via the decryption path that decompresses plaintext, enabling potential CPU/memory exhaustion. Multiple connected advisories confirm this vulnerability across several distributions ( MiracleLinux, Alibaba Cloud Linux, TencentOS Server ) and...

CVE-2024-28176 jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens JWT, JSON Web Signature JWS, JSON Web Encryption JWE, JSON Web Key JWK, JSON Web Key Set JWKS, and more. A vulnerability has been identified in the JSON Web Encryption JWE decryption interfaces...

jose Security Vulnerabilities

jose is a JavaScript module for signing and encrypting JSON objects. A security vulnerability exists in jose versions prior to 2.0.7 and 4.15.5 that could allow an attacker to exhaust resources via a specially crafted JWE with compressed plaintext...

CVE-2024-24885

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lê Văn Toản Woocommerce Vietnam Checkout allows Stored XSS.This issue affects Woocommerce Vietnam Checkout: from n/a through 2.0.7...

PT-2024-20641 · Woocommerce · Woocommerce Vietnam Checkout

Name of the Vulnerable Software and Affected Versions: WooCommerce Vietnam Checkout versions 2.0.7 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means an attacker can inject...

WordPress PropertyHive Plugin <= 2.0.6 is vulnerable to Broken Access Control

Software PropertyHive Type Plugin Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-24718 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4eea0b5c54d4 Credits Yudistira Arya Required privileg...

PT-2024-19484 · Whatacart · Whatacart

Name of the Vulnerable Software and Affected Versions: WhatACart version 2.0.7 Description: A reflected cross-site scripting XSS issue was discovered in WhatACart via the /site/default/search component. This allows for potential malicious script injection and execution. Recommendations: For...

Usha InformatiqueC WhatACart Cross-Site Scripting Vulnerability

Usha InformatiqueC WhatACart is an open source online e-commerce solution from Usha InformatiqueC built on the Yii2 framework. A cross-site scripting vulnerability exists in Usha InformatiqueC WhatACart version v2.0.7, which stems from cross-site scripting contained in the component...

PT-2024-15789 · Unknown · Pcman Ftp Server

Name of the Vulnerable Software and Affected Versions: PCMan FTP Server version 2.0.7 Description: A vulnerability was found in the STOR Command Handler component of PCMan FTP Server, which can lead to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the...

PT-2024-11030 · Unknown · Pcman Ftp Server

Name of the Vulnerable Software and Affected Versions: PCMan FTP Server version 2.0.7 Description: A vulnerability was found in the USER Command Handler component of PCMan FTP Server, which can lead to denial of service. The attack can be initiated remotely. Recommendations: For PCMan FTP Server...

WordPress Depicter Slider Plugin <= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Depicter Slider Type Plugin Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-6493 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 15e2f683e7f4 Credits Rafshanzani Suhada...

CVE-2018-25097 Acumos Design Studio cross site scripting

A vulnerability, which was classified as problematic, was found in Acumos Design Studio up to 2.0.7. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.8 is able to address this issue. The name of...