CVE-2024-28895

'Yahoo! JAPAN' App for Android v2.3.1 to v3.161.1 and 'Yahoo! JAPAN' App for iOS v3.2.2 to v4.109.0 contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the WebView of 'Yahoo! JAPAN' App via other app installed on the user's devi...

WordPress List category posts Plugin <= 0.89.6 is vulnerable to Cross Site Scripting (XSS)

Software List category posts Type Plugin Vulnerable versions = 0.89.6 Fixed in 0.89.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1051 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a918041d1b8e Credits Ngô Thiên An ancor...

Technicolor TC8715D Cross-Site Scripting Vulnerability

The Technicolor TC8715D is a wireless router from the French company Technicolor. Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T suffers from a cross-site scripting vulnerability that can be exploited by an attacker to obtain sensitive information such as user cookies...

WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Responsive Image Gallery, Gallery Album Type Plugin Vulnerable versions = 2.0.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31120 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 982538f631cc Credits LVT-tholv2k...

Inventory Management System Category Name Parameter Cross-Site Scripting Vulnerability

Inventory Management System is an inventory management system. Inventory Management System 20240320 and earlier versions suffer from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by the parameters Category Name/Model...

IBM WebSphere Application Server Liberty Cross-Site Scripting Vulnerability (CNVD-2024-15727)

IBM WebSphere Application Server Liberty is a Java application server from International Business Machines IBM built on top of the Open Liberty project. A cross-site scripting vulnerability exists in IBM WebSphere Application Server Liberty versions 23.0.0.3 through 24.0.0.3, which stems from the...

IBM QRadar SIEM Cross-Site Scripting Vulnerability (CNVD-2024-15725)

IBM QRadar SIEM is a solution from International Business Machines IBM that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user...

Dell InsightIQ Access Control Error Vulnerability

Dell InsightIQ is a performance monitoring and reporting tool from Dell USA. An Access Control Error vulnerability exists in Dell InsightIQ version 5.0, which stems from incorrect access control in the application and can be exploited by an attacker to gain unauthorized access to monitoring data...

WordPress WP Cost Estimation & Payment Forms Builder Plugin <= 10.1.75 is vulnerable to SQL Injection

Software WP Cost Estimation & Payment Forms Builder Type Plugin Vulnerable versions = 10.1.75 Fixed in 10.1.76 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30489 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID b42e5deb44b6 Credits Rafie Muhammad...

WordPress Simple Revisions Delete Plugin <= 1.5.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Simple Revisions Delete Type Plugin Vulnerable versions = 1.5.3 Fixed in 1.5.4 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-30482 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 18dcb3152bfd Credits Brandon...

WordPress Element Pack Elementor Addons Plugin <= 5.5.3 is vulnerable to SQL Injection

Software Element Pack Elementor Addons Type Plugin Vulnerable versions = 5.5.3 Fixed in 5.5.4 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30496 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 3d0133376896 Credits Rafie Muhammad Patchstack Required...

Rockwell Automation Arena Simulation Software Arbitrary Code Execution Vulnerability

Rockwell Automation Arena Simulation Software is a suite of simulation software from Rockwell Automation that provides 3D animation and graphics capabilities. An arbitrary code execution vulnerability exists in Rockwell Automation Arena Simulation Software, which can be exploited by an attacker t...

WordPress Simple Ajax Chat Plugin <= 20231101 is vulnerable to Cross Site Scripting (XSS)

Software Simple Ajax Chat Type Plugin Vulnerable versions = 20231101 Fixed in 20240216 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2956 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1403f71c8e2b Credits Fourcade Required...

Exploit for Improper Access Control in Adobe Coldfusion

CVE-2024-20767 CVE-2024-20767https://nvd.nist.gov/vuln...

CISA Alerts on Active Exploitation of Flaws in Fortinet, Ivanti, and Nice Products

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday placed three security flaws to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The vulnerabilities added are as follows - CVE-2023-48788 CVSS score: 9.3 - Fortinet FortiClient EMS SQL...

IBM Cloud Pak for Automation CSV Injection Vulnerability

IBM Cloud Pak for Automation is an intelligent software platform for building automation applications in cloud environments from International Business Machines IBM. The platform uses pre-integrated automation technologies and low-code tools to design, build and run automation applications and...

CVE-2024-29059

creationtimestamp| type| source ---|---|--- 2024-03-25 13:00:53+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/6850 2024-03-25 15:32:15+00:00| published-proof-of-concept| https://t.me/CNArsenal/2179 2024-03-25 15:32:50+00:00| published-proof-of-concept|...

WordPress Hot Random Image Plugin <= 1.8.1 is vulnerable to Cross Site Scripting (XSS)

Software Hot Random Image Type Plugin Vulnerable versions = 1.8.1 Fixed in 1.8.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29796 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 63fa0707da67 Credits Ngô Thiên An ancorn from VNPT-VCI...

WordPress WooCommerce Clover Payment Gateway Plugin <= 1.3.1 is vulnerable to Broken Access Control

Software WooCommerce Clover Payment Gateway Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0626 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 06c0aefba99a Credits Francesco...

PT-2024-2375

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions prior to 4.8.4682.0/4.8.9206.0 Description The vulnerability is related to insufficient protection of service data when processing ObjRef objects, which may allow a remote attacker to gain unauthorized access ...