WordPress GamiPress Plugin <= 6.8.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software GamiPress Type Plugin Vulnerable versions = 6.8.5 Fixed in 6.8.6 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-30455 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7284ec56cbcf Credits Ananda Dhakal Patchstack Requir...

Schneider Electric EcoStruxure Power Design - Ecodial BinSerializer Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Design - Ecodial. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific...

WordPress Salon booking system Plugin <= 9.5 is vulnerable to Arbitrary File Upload

Software Salon booking system Type Plugin Vulnerable versions = 9.5 Fixed in 9.5.1 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Upload CVE CVE-2024-30510 Patch priority Medium CVSS severity Medium 10 Developer Claim ownership PSID 17f873db702b Credits stealthcopter Required...

CVE-2023-33322

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Etoile Web Design Front End Users allows Reflected XSS.This issue affects Front End Users: from n/a before 3.2.25...

CVE-2023-33322

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Etoile Web Design Front End Users allows Reflected XSS.This issue affects Front End Users: from n/a before 3.2.25...

CVE-2023-33322 WordPress Front End Users plugin < 3.2.25 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Etoile Web Design Front End Users allows Reflected XSS.This issue affects Front End Users: from n/a before 3.2.25...

CVE-2023-33322

CVE-2023-33322 affects WordPress plugin Front End Users (front-end-only users). The issue is an improper neutralization of input during web page generation, leading to Reflected XSS. Affected versions are before 3.2.25; patch to 3.2.25 fixes the vulnerability. Users should update to the fixed ver...

PT-2024-12427 · Unknown · Etoile Web Design Front End Users

Name of the Vulnerable Software and Affected Versions: Etoile Web Design Front End Users versions prior to 3.2.25 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

WordPress RegistrationMagic Plugin <= 5.3.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software RegistrationMagic Type Plugin Vulnerable versions = 5.3.0.0 Fixed in 5.3.1.0 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-2951 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1d9399326561 Credits Joshua Chan Required...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2024-1408)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerabilities of software for network design, calculation of electrical network parameters, and procurement of EcoStruxure Power Design/Ecodial (formerly Ecodial) equipment relate to shortcomings in the deserialization mechanism, allowing attackers to execute arbitrary code.

The vulnerability of software for designing electrical power networks, calculating network electrical parameters, and selecting equipment for EcoStruxure Power Design/Ecodial formerly Ecodial stems from deficiencies in the deserialization mechanism during file loading. Exploiting this vulnerabili...

CVE-2024-25597

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Etoile Web Design Ultimate Reviews allows Stored XSS.This issue affects Ultimate Reviews: from n/a through 3.2.8...

CVE-2024-25597

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Etoile Web Design Ultimate Reviews allows Stored XSS.This issue affects Ultimate Reviews: from n/a through 3.2.8...

CVE-2024-25597 WordPress Ultimate Reviews plugin <= 3.2.8 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Etoile Web Design Ultimate Reviews allows Stored XSS.This issue affects Ultimate Reviews: from n/a through 3.2.8...

CVE-2024-25597

CVE-2024-25597 affects WordPress plugin Ultimate Reviews (Etoile Web Design) up to version 3.2.8. The issue is unauthorized, stored XSS triggered via the reviews feature due to improper input handling during page generation. The vulnerability is addressed in version 3.2.9 (patched). No exploitati...

Malicious code in geico_design_kit2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fb947e32f21c9faa279b825aa5989d3a6fcbe09de00409c630dd824dc5ce42f0 The OpenSSF Package Analysis project identified 'geicodesignkit2' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in geico_design_kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0943eac5b10af47669f7e61c098c7804610dbb51c46b3c716e5667821d36ff1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Vulnerability fixed in Schneider Electric EcoStruxure Power Design

Schneider Electric has fixed a vulnerability in EcoStruxure Power Design. A malicious party could exploit the vulnerability to execute arbitrary code with privileges of the Power Design user. Successful exploitation requires the malicious party to trick the victim into opening and executing a rog...

Design/Logic Flaw

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the bookingexportall function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with...

Design/Logic Flaw

The Auto Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the aalAddLink function in all versions up to, and including, 6.4.3. This makes it possible for authenticated attackers, with subscriber access or higher, to add...