PT-2025-1524 · Unknown · Tcbarrett Glossary

Name of the Vulnerable Software and Affected Versions: TCBarrett Glossary versions 3.1.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For TCBarrett Glossary...

WordPress plugin Hestia 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site reques...

CVE-2024-56228

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce.This issue affects Wishlist for WooCommerce: from n/a through = 3.1.2...

CVE-2024-56228

CVE-2024-56228 affects Wishlist for WooCommerce: Multi Wishlists Per Customer (WordPress plugin) up to version 3.1.2. It is a Reflected Cross-Site Scripting vulnerability caused by improper neutralization of input during web page generation. CVSS v3.1 base score 7.1 (HIGH); attack vector NETWORK,...

CVE-2024-56228 WordPress Wishlist for WooCommerce: Multi Wishlists Per Customer plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce.This issue affects Wishlist for WooCommerce: from n/a through = 3.1.2...

WordPress plugin Wishlist for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

AZL-54654 CVE-2024-56326 affecting package python-jinja2 for versions less than 3.1.2-2

Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the...

WordPress Wishlist for WooCommerce: Multi Wishlists Per Customer plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin Wishlist for WooCommerce versions = 3.1.2...

CVE-2024-54286

CVE-2024-54286 details (connected docs) : Affected product is the Smaily for WP WordPress plugin by Sendsmaily. The issue is a Stored Cross-Site Scripting (XSS) vulnerability arising from improper input neutralization during web page generation. Impact is stored XSS on sites running Smaily for WP...

PT-2024-17451 · WordPress · The Simple Ecommerce Shopping Cart Plugin

Name of the Vulnerable Software and Affected Versions: The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress versions up to, and including, 3.1.2 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and...

WordPress Wishlist for WooCommerce Pro plugin <= 3.1.2 Reflected Cross-Site Scripting vulnerability

WordPress Wishlist for WooCommerce Pro plugin = 3.1.2 Reflected Cross-Site Scripting vulnerability discovered by kr0d in WordPress Plugin Wishlist for WooCommerce Pro versions = 3.1.2...

CVE-2024-43338

CVE-2024-43338 is a CSRF vulnerability in Crowdsignal Dashboard – Polls, Surveys & more (WordPress plugin Crowdsignal) affecting versions up to and including 3.1.2. The issue permits Cross Site Request Forgery with CVSS v3.1 base score 4.3 (Medium). Connected Patchstack entries classify the vulne...

Zoraxy 操作系统命令注入漏洞

Zoraxy is a general-purpose HTTP reverse proxy and forwarding tool from the individual developer Toby Chui. An operating system command injection vulnerability exists in Zoraxy versions 2.6.1 through 3.1.2 that originates from allowing an authenticated attacker to execute arbitrary commands as ro...

CVE-2024-51739

Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in...

CVE-2024-51739 Users enumeration allowed through Rest API in Combodo iTop

Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in...

CVE-2024-51739 Users enumeration allowed through Rest API in Combodo iTop

Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in...

CVE-2024-31998

Combodo iTop is a simple, web based IT Service Management tool. A CSRF can be performed on CSV import simulation. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability...

PT-2024-34874 · Comodo +1 · Itop +1

Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 2.7.11 Combodo iTop versions prior to 3.0.5 Combodo iTop versions prior to 3.1.2 Combodo iTop versions prior to 3.2.0 Description: The issue allows an unauthenticated user to perform user enumeration, making it...

CVE-2024-31998 CSRF security issue on CSV import in Combodo iTop

Combodo iTop is a simple, web based IT Service Management tool. A CSRF can be performed on CSV import simulation. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability...

CVE-2024-31998 CSRF security issue on CSV import in Combodo iTop

Combodo iTop is a simple, web based IT Service Management tool. A CSRF can be performed on CSV import simulation. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability...