PT-2024-14705 · Unknown · Hwnff Module

Name of the Vulnerable Software and Affected Versions: hwnff module affected versions not specified Description: The issue is related to defects introduced in the design process in the hwnff module. Successful exploitation of this vulnerability may affect service confidentiality. Recommendations:...

free-factory.design Cross Site Scripting vulnerability OBB-3906923

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

design-interior.ck.ua Cross Site Scripting vulnerability OBB-3905563

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

VulnCheck KEV: CVE-2024-31231

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Sizam Design Rehub allows PHP Local File Inclusion.This issue affects Rehub: from n/a through 19.6.1...

CVE-2024-3165

System-Maintenance- Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment. OWASP Top 10 - A05 Insecure Design OWASP Top...

CVE-2024-3164

In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System...

CVE-2024-3165 Database Credential Exposure in the Logs

System-Maintenance- Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment. OWASP Top 10 - A05 Insecure Design OWASP Top...

CVE-2024-3165

CVE-2024-3165 affects dotCMS where the System->Maintenance-> Log Files output reveals database credentials (username/password) in logs. This is described as a moderate issue requiring backend admin access and environment-led DB lockdown. Connected documents confirm the vulnerability stems f...

CVE-2024-3165 Database Credential Exposure in the Logs

System-Maintenance- Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment. OWASP Top 10 - A05 Insecure Design OWASP Top...

CVE-2024-3165 Database Credential Exposure in the Logs

System-Maintenance- Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment. OWASP Top 10 - A05 Insecure Design OWASP Top...

CVE-2024-3164

The CVE-2024-3164 issue affects dotCMS where the Tools and Log Files tabs under System → Maintenance Portlet are accessible to any user with the portlet, not just CMS Admins. The vulnerability arises from broken access control, allowing site-admin users (without system-admin privileges) to access...

CVE-2024-3164

In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System...

PT-2024-24175 · Dotcms · Dotcms

Name of the Vulnerable Software and Affected Versions: dotCMS affected versions not specified Description: The issue is related to the System-Maintenance- Log Files in the dotCMS dashboard, which is providing the username/password for database connections in the log output. This is considered a...

CVE-2024-31084

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pulsar Web Design Weekly Class Schedule allows Reflected XSS.This issue affects Weekly Class Schedule: from n/a through 3.19...

CVE-2024-31084

CVE-2024-31084 is a Reflected XSS in Pulsar Web Design Weekly Class Schedule (WordPress plugin) affecting versions up to 3.19. The description notes improper input neutralization during web page generation. The connected Red Hat entry and other sources corroborate the vulnerability as Cross‑Site ...

CVE-2024-31084 WordPress Weekly Class Schedule plugin <= 3.19 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pulsar Web Design Weekly Class Schedule allows Reflected XSS.This issue affects Weekly Class Schedule: from n/a through 3.19...

PT-2024-23752 · Unknown · Pulsar Web Design Weekly Class Schedule

Name of the Vulnerable Software and Affected Versions: Pulsar Web Design Weekly Class Schedule versions through 3.19 Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. This allows for Reflected...

WordPress WP Express Checkout (Accept PayPal Payments) Plugin <= 2.3.7 is vulnerable to Other Vulnerability Type

Software WP Express Checkout Accept PayPal Payments Type Plugin Vulnerable versions = 2.3.7 Fixed in 2.3.8 OWASP Top 10 A4: Insecure Design Classification Other Vulnerability Type CVE CVE-2024-30527 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID e7e1b499917d Credits Xinzh...

CVE-2024-30228

Deserialization of Untrusted Data vulnerability in Hercules Design Hercules Core.This issue affects Hercules Core : from n/a through 6.4...

WordPress Tumult Hype Animations Plugin <= 1.9.11 is vulnerable to Cross Site Request Forgery (CSRF)

Software Tumult Hype Animations Type Plugin Vulnerable versions = 1.9.11 Fixed in 1.9.12 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-30460 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c704327afb62 Credits Majed Refaea...