WordPress Modern Events Calendar plugin <= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery vulnerability

Authenticated Subscriber+ Server Side Request Forgery vulnerability discovered by Foxyyy in WordPress Plugin Modern Events Calendar versions = 7.12.1...

WordPress Modern Events Calendar Lite plugin <= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery vulnerability

Authenticated Subscriber+ Server Side Request Forgery vulnerability discovered by Foxyyy in WordPress Plugin Modern Events Calendar Lite versions = 7.12.1...

kernel: drm/vmwgfx: Fix invalid reads in fence signaled events

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix invalid reads in fence signaled events Correctly set the length of the drmevent to the size of the structure that's actually used. The length of the drmevent was set to the parent structure instead of to the...

WordPress Registrations for the Events Calendar Plugin <= 2.12.1 is vulnerable to Broken Access Control

Software Registrations for the Events Calendar Type Plugin Vulnerable versions = 2.12.1 Fixed in 2.12.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43143 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 462ae8831c53 Credits Manab...

WordPress Modern Events Calendar Lite Plugin <= 7.12.1 is vulnerable to Server Side Request Forgery (SSRF)

Software Modern Events Calendar Lite Type Plugin Vulnerable versions = 7.12.1 Fixed in 7.13.0 OWASP Top 10 A1: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2024-6522 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 910627b36a58 Credits Foxyy...

WordPress Modern Events Calendar Plugin <= 7.12.1 is vulnerable to Server Side Request Forgery (SSRF)

Software Modern Events Calendar Type Plugin Vulnerable versions = 7.12.1 Fixed in 7.13.0 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-6522 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 2c1730c6aa47 Credits Foxyyy Required...

WordPress plugin Modern Events Calendar 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...

CVE-2024-33989

Cross-Site Scripting XSS vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the 'eventdate' and 'events'...

CVE-2024-33989 Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System

Cross-Site Scripting XSS vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the 'eventdate' and 'events'...

CVE-2024-33987

The CVE-2024-33987 entry describes a Cross-Site Scripting (XSS) vulnerability in Janobe’s School Attendance Monitoring System and School Event Management System (version 1.0). The issue allows an attacker to craft a URL targeting parameters such as Attendance, attenddate, YearLevel, eventdate, ev...

CVE-2024-33987 Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting XSS vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate', 'YearLevel...

CVE-2024-33972

SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'events' in '/report/eventprint.php'...

CVE-2024-33972

SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'events' in '/report/eventprint.php'...

CVE-2024-33972 SQL injection in Janobe products

SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'events' in '/report/eventprint.php'...

SUSE CVE-2024-26762

In the Linux kernel, the following vulnerability has been resolved: cxl/pci: Skip to handle RAS errors if CXL.mem device is detached The PCI AER model is an awkward fit for CXL error handling. While the expectation is that a PCI device can escalate to link reset to recover from an AER event, the...

SUSE CVE-2024-42075

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix remap of arena. The bpf arena logic didn't account for mremap operation. Add a refcnt for multiple mmap events to prevent use-after-free in arenavmclose...

SUSE CVE-2024-42139

In the Linux kernel, the following vulnerability has been resolved: ice: Fix improper extts handling Extts events are disabled and enabled by the application ts2phc. However, in case where the driver is removed when the application is running, a specific extts event remains enabled and can cause ...

PT-2024-25621 · Unknown · School Management System

Name of the Vulnerable Software and Affected Versions: School Event Management System version 1.0 Description: A Cross-Site Scripting XSS issue exists, allowing an attacker to partially take over an authenticated user's browser session. This can be achieved by sending a specially crafted javascri...

School Event Management System 跨站脚本漏洞

School Event Management System is a school event management system. A cross-site scripting vulnerability exists in School Event Management System version 1.0. An attacker can use this vulnerability to send a specially crafted JavaScript load to a user to take over their browser session via the...

PT-2024-25604 · Paypal · Paypal

Name of the Vulnerable Software and Affected Versions: PayPal, Credit Card and Debit Card Payment version 1.0 Description: The issue allows an attacker to exploit a SQL injection vulnerability by sending a specially crafted query to the server. This can lead to the retrieval of all information...