212 matches found
HPESBST04635 rev.1 - HPE SAN Switches with Brocade Fabric OS (FOS), Multiple Remote and Local Vulnerabilities
Potential Security Impact: Local: Multiple Vulnerabilities; Remote: Multiple Vulnerabilities SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE B-series SN2600B SAN Extension Switch - Prior to v9.2.1, v9.2.0b and v9.1.1d HPE B-series SN3600B Fibre Channel Switch - Prior to v9.2.1...
CVE-2024-1571
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video Embed parameter in all versions up to, and including, 9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the recipe...
WordPress Plugin WP Recipe Maker 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
PT-2024-18141 · WordPress · Wp Recipe Maker
Name of the Vulnerable Software and Affected Versions: WP Recipe Maker plugin for WordPress versions up to and including 9.2.1 Description: The issue arises from insufficient input sanitization and output escaping in the Video Embed parameter, allowing authenticated attackers to inject arbitrary...
CVE-2024-29945
In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the software potentially exposes authentication tokens during the token validation process. This exposure happens when either Splunk Enterprise runs in debug mode or the JsonWebToken component has been configured to log its activity at...
CVE-2024-29946 Risky command safeguards bypass in Dashboard Examples Hub
In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phish the victim by tricking them into...
CVE-2024-29946
CVE-2024-29946 affects Splunk Enterprise versions older than 9.2.1, 9.1.4, and 9.0.9. The Dashboard Examples Hub lacks protections for risky SPL commands, potentially allowing bypass of safeguards. The attack requires phishing the victim into initiating a browser request. Remediation per connecte...
PT-2024-2533 · Splunk · Splunk Enterprise
Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.2.1 Splunk Enterprise versions prior to 9.1.4 Splunk Enterprise versions prior to 9.0.9 Description: The issue is related to the lack of protections for risky SPL commands in the Dashboard Examples Hub...
OESA-2023-1974 trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache. Security Fixes: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic...
CVE-2023-44760
Multiple Cross Site Scripting XSS vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics. NOTE: the vendor disputes this because these header/footer changes can only be made by an...
ConcreteCMS Cross-site Scripting vulnerability
A Cross Site Scripting XSS vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SITE parameter from installation or in the Settings...
GHSA-6XX7-R8X4-FPJP ConcreteCMS Cross-site Scripting vulnerability
A Cross Site Scripting XSS vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings...
CVE-2023-44761
Multiple Cross Site Scripting XSS vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects...
CVE-2023-44765
A Cross Site Scripting XSS vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings...
Cross site scripting
Multiple Cross Site Scripting XSS vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects...
Cross site scripting
A Cross Site Scripting XSS vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made by an admin, and allowing an admin to...
PT-2023-29290 · Unknown · Concrete Cms
Name of the Vulnerable Software and Affected Versions: Concrete CMS version 9.2.1 Description: A Cross Site Scripting XSS issue allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. Note that the vendor disputes this, stating that allowing an adm...
PortlandLabs Concrete CMS Cross-Site Scripting Vulnerability
PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS version v.9.2.1, which stems from a cross-site scripting XSS vulnerability in the Site paramete...
PortlandLabs Concrete CMS Cross-Site Scripting Vulnerability
PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS version v.9.2.1, which stems from a cross-site scripting XSS vulnerability in the System&Settin...