CVE-2024-45429

Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the...

CVE-2024-45429

CVE-2024-45429 is a cross-site scripting vulnerability in the WordPress plugins Advanced Custom Fields and Advanced Custom Fields Pro, affecting versions ≤ 6.3.5. The issue arises when an attacker who has the product’s configured capability privilege stores an arbitrary script in a field label, a...

WordPress Plugin "Advanced Custom Fields" vulnerable to cross-site scripting

Overview The field labels in WordPress Plugin "Advanced Custom Fields" provided by WP Engine contains a cross-site scripting vulnerability CWE-79. Ryo Sotoyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

JVN#67963942: WordPress Plugin "Advanced Custom Fields" vulnerable to cross-site scripting

The field labels in WordPress Plugin "Advanced Custom Fields" provided by WP Engine contains a cross-site scripting vulnerability CWE-79. Impact If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the script ma...

CVE-2024-45429: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the...

PT-2024-31626 · Unknown · Advanced Custom Fields Pro

Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields versions 6.3.5 and earlier Advanced Custom Fields Pro versions 6.3.5 and earlier Description: A cross-site scripting issue exists, allowing an attacker with the capability setting privilege to store an arbitrary script ...

WordPress plugin Advanced Custom Fields and WordPress plugin Advanced Custom Fields Pro have security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Exploit for Improper Initialization in Linux Linux_Kernel

It is an exploit module/toolkit targeting unspecified products/s...

kernel: crypto: qat - resolve race condition during AER recovery

A race condition was found in drivers/crypto/intel/qat/qatcommon/adfaer.c in the Linux kernel during AER recovery...

hw: amd: SMM Lock Bypass

A flaw was found in hw. Improper validation in a model-specific register MSR could allow a malicious program with ring0 access to modify the SMM configuration while the SMI lock is enabled. This issue can lead to arbitrary code execution...

Authenticator encryption vulnerabilities

Authenticator is an open source authenticator from Authenticator Extension. An encryption issue vulnerability exists in Authenticator version 7.0.0 and prior versions, which stems from the fact that user data encryption keys are stored using only AES-256 and EVPBytesToKey KDF, which could lead to...

Next-Generation Attacks, Same Targets - How to Protect Your Users' Identities

The FBI and CISA Issue Joint Advisory on New Threats and How to Stop Ransomware Note: on August 29, the FBI and CISA issued a joint advisory as part of their ongoing StopRansomware effort to help organizations protect against ransomware. The latest advisory, AA24-242A, describes a new cybercrimin...

PT-2024-6023 · Zyxel · Zyxel Usg Flex Series +3

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions V4.32 through V5.38 Zyxel USG FLEX series versions V4.50 through V5.38 Zyxel USG FLEX 50W series versions V4.16 through V5.38 Zyxel USG20W-VPN series versions V4.16 through V5.38 Description: The issue is related to ...

Cyberattackers Exploit Google Sheets for Malware Control in Likely Espionage Campaign

Cybersecurity researchers have uncovered a novel malware campaign that leverages Google Sheets as a command-and-control C2 mechanism. The activity, detected by Proofpoint starting August 5, 2024, impersonates tax authorities from governments in Europe, Asia, and the U.S., with the goal of targeti...

NetIQ Advanced Authentication Information Disclosure Vulnerability

NetIQ Advanced Authentication is an application from NetIQ UK. It provides a more secure way to protect your sensitive information by moving away from usernames and passwords. An information disclosure vulnerability exists in NetIQ Advance Authentication versions prior to 6.3.5.1, which can be...

NetIQ Advanced Authentication Brute Force Vulnerability

NetIQ Advanced Authentication is an application from NetIQ UK. It provides a more secure way to protect your sensitive information by moving away from usernames and passwords. A brute force vulnerability exists in NetIQ Advanced Authentication versions prior to 6.3.5.1, which stems from not...

Unspecified Vulnerability in NetIQ Advanced Authentication (CNVD-2024-38198)

NetIQ Advanced Authentication is an application from NetIQ UK. It provides a more secure way to protect your sensitive information by moving away from usernames and passwords. A security vulnerability exists in NetIQ Advanced Authentication versions prior to 6.3.5.1 that stems from an insufficien...

NetIQ Advanced Authentication Cross-Site Scripting Vulnerability

NetIQ Advanced Authentication is an application from NetIQ UK. It provides a more secure way to protect your sensitive information by moving away from usernames and passwords. A cross-site scripting vulnerability exists in NetIQ Advanced Authentication versions prior to 6.3.5.1, which stems from ...

Unspecified Vulnerability in NetIQ Advanced Authentication (CNVD-2024-38199)

NetIQ Advanced Authentication is an application from NetIQ UK. It provides a more secure way to protect your sensitive information by moving away from usernames and passwords. A security vulnerability exists in NetIQ Advanced Authentication versions prior to 6.3.5.1, which can be exploited by an...

NetIQ Advanced Authentication Command Execution Vulnerability

NetIQ Advanced Authentication is an application from NetIQ UK. It provides a more secure way to protect your sensitive information by moving away from usernames and passwords. A command execution vulnerability exists in NetIQ Advanced Authentication versions prior to 6.3.5.1, which can be exploit...