PT-2024-31562 · WordPress · Business Card Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Business Card WordPress plugin versions prior to 1.1 Description: The issue is related to the lack of CSRF checks in certain areas, allowing attackers to potentially make logged-in users perform unwanted actions, such as editing cards, throug...

CVE-2024-36255 Post actions can run playbook checklist task commands

Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in...

CVE-2024-36255 Post actions can run playbook checklist task commands

Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in...

PT-2024-5294 · Zoho · Zoho Manageengine Servicedesk Plus +1

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus versions below 14730 Zoho ManageEngine ServiceDesk Plus MSP versions below 14720 Zoho ManageEngine SupportCenter Plus versions below 14720 Description: The vulnerability exists in the Custom Actions componen...

Cross-site Scripting (XSS)

ezsystems/ezfind-ls is vulnerable to Cross-site Scripting XSS. The vulnerability is caused due to the lack of proper sanitization of the $searchextras.spellcheckcollation variable in the "Did you mean...?" spell check/search suggestion feature. This may lead to unauthorized code execution,...

UBUNTU-CVE-2024-5138

The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to trigger an authorised action on behalf of...

Cross-Site Request Forgery (CSRF)

ezsystems/ezplatform is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to the CSRF protection which is not enabled by default., which allows attackers to perform unauthorized actions by exploiting the inactive CSRF token...

CVE-2024-0867

CVE-2024-0867 – Email Log (WordPress) vulnerability : Unauthenticated Hook Injection in all versions up to 2.4.8 via check_nonce. An attacker can execute actions with hooks without authentication under conditions where a nonce check is present and a nonce is known, and where there is no capabilit...

ManageEngine ServiceDesk Plus < 14.7 Build 14730

The version of ManageEngine ServiceDesk Plus installed on the remote host is prior to 14.7 Build 14730. It is, therefore, affected by a vulnerability as referenced in the service-deskcve-2024-27314 advisory. - A stored cross-site scripting XSS vulnerability allowed users with the SDAdmin role to...

PT-2024-6092 · Snapd +2 · Snapd +2

Name of the Vulnerable Software and Affected Versions: snapd affected versions not specified Description: The issue is related to the snapctl component within snapd, which allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was fou...

ManageEngine SupportCenter Plus < 14.7 Build 14720

The version of ManageEngine SupportCenter Plus installed on the remote host is prior to 14.7 Build 14720. It is, therefore, affected by a vulnerability as referenced in the support-centercve-2024-27314 advisory. - A stored cross-site scripting XSS vulnerability allowed users with the SDAdmin role...

ManageEngine ServiceDesk Plus MSP < 14.7 Build 14720

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 14.7 Build 14720. It is, therefore, affected by a vulnerability as referenced in the service-desk-mspcve-2024-27314 advisory. - A stored cross-site scripting XSS vulnerability allowed users with the SDAdmin...

GHSA-W8FQ-XGVH-CXC2 Silverstripe Forum Module CSRF Vulnerability

A number of form actions in the Forum module are directly accessible. A malicious user e.g. spammer can use GET requests to create Members and post to forums, bypassing CSRF and anti-spam measures. Additionally, a forum moderator could be tricked into clicking a specially crafted URL, resulting i...

Cross Site Scripting (XSS)

phpxmlrpc/extras is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to inadequate input validation within the documentingxmlrpcserver class when processing the GET methodName parameter, which allows attackers to execute malicious scripts in the context of the user's browser,...

xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions

A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved...

xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions

A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved...

PT-2024-26538 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: The issue is related to a Cross-Site Request Forgery CSRF in the component /admin/infoMove deal.php with parameters mudi=del, dataType=logo, and dataTypeCN. This allows for unauthorized actions to be performed...

PT-2024-26548 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in idccms via the component /admin/ca deal.php?mudi=add&nohrefStr=close. This allows for unauthorized actions to be performed on behalf of a user...

PT-2024-26545 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: The issue is related to a Cross-Site Request Forgery CSRF in the component "/admin/infoMove deal.php" with parameters mudi and nohrefStr. This allows for unauthorized actions. Recommendations: For idccms versi...

PT-2024-26547 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: The issue is related to a Cross-Site Request Forgery CSRF in the /admin/ca deal.php component. The API Endpoint "/admin/ca deal.php" is vulnerable, specifically with parameters mudi=del and empty dataType and...