WordPress Advanced Custom Fields PRO plugin < 5.11 - Missing Authorization to Information Disclosure vulnerability

Missing Authorization to Information Disclosure vulnerability discovered by Keitaro Yamazaki in WordPress Plugin Advanced Custom Fields PRO versions 5.11...

WordPress Advanced Custom Fields plugin < 5.11 - Missing Authorization to Information Disclosure vulnerability

Missing Authorization to Information Disclosure vulnerability discovered by Keitaro Yamazaki in WordPress Plugin Advanced Custom Fields versions 5.11...

WordPress Advanced Custom Fields PRO plugin < 5.11 - Missing Authorization on Option Changes vulnerability

Missing Authorization on Option Changes vulnerability discovered by Keitaro Yamazaki in WordPress Plugin Advanced Custom Fields PRO versions 5.11...

WordPress Advanced Custom Fields plugin < 5.11 - Missing Authorization on Option Changes vulnerability

Missing Authorization on Option Changes vulnerability discovered by Keitaro Yamazaki in WordPress Plugin Advanced Custom Fields versions 5.11...

WordPress Advanced Custom Fields Plugin < 5.11 is vulnerable to Broken Access Control

Software Advanced Custom Fields Type Plugin Vulnerable versions 5.11 Fixed in 5.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2021-20867 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 205fd390910c Credits Keitaro Yamazaki Required...

WordPress Advanced Custom Fields PRO Plugin < 5.11 is vulnerable to Broken Access Control

Software Advanced Custom Fields PRO Type Plugin Vulnerable versions 5.11 Fixed in 5.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2021-20866 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 36e7531caa36 Credits Keitaro Yamazaki...

WordPress Advanced Custom Fields PRO Plugin < 5.11 is vulnerable to Broken Access Control

Software Advanced Custom Fields PRO Type Plugin Vulnerable versions 5.11 Fixed in 5.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2021-20867 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 38d705c1f970 Credits Keitaro Yamazaki...

WordPress Advanced Custom Fields Plugin < 5.11 is vulnerable to Broken Access Control

Software Advanced Custom Fields Type Plugin Vulnerable versions 5.11 Fixed in 5.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2021-20866 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3c61745fb42a Credits Keitaro Yamazaki Required...

PT-2024-7391

Name of the Vulnerable Software and Affected Versions: Starlette versions prior to 0.40.0 Description: The issue is related to how Starlette handles multipart/form-data parts without a filename, treating them as text form fields and buffering them in byte strings with no size limit. This allows a...

WordPress Advanced Custom Fields Plugin < 5.11 is vulnerable to Broken Access Control

Software Advanced Custom Fields Type Plugin Vulnerable versions 5.11 Fixed in 5.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2021-20865 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4a4b648ba0bb Credits Keitaro Yamazaki Required...

PT-2024-39573 · Intelbras · Intelbras Incontrol

Name of the Vulnerable Software and Affected Versions: Intelbras InControl versions up to 2.21.57 Description: A critical issue affects some unknown functionality of the file /v1/operador/ of the component Relatório de Operadores Page. The manipulation of the fields argument leads to code...

Online Railway Reservation System 跨站脚本漏洞

Online Railway Reservation System is an online railroad reservation system by adminastro individual developers. A cross-site scripting vulnerability exists in SourceCodester Online Railway Reservation System version 1.0, which stems from a cross-site scripting issue with the First Name/Middle...

CVE-2024-7617

The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 form fields in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-41725

ProGauge MAGLINK LX CONSOLE does not have sufficient filtering on input fields that are used to render pages which may allow cross site scripting...

kernel: nbd: always initialize struct msghdr completely

In the Linux kernel, the following vulnerability has been resolved: nbd: always initialize struct msghdr completely syzbot complains that msg-msggetinq value can be uninitialized 1 struct msghdr got many new fields recently, we should always make sure their values is zero by default. 1 BUG: KMSAN...

kernel: firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files

A buffer overrun flaw exists in the Linux kernel when the strlen function is used on name fields in V1 wmfw files. This issue results in a loss of system availability...

kernel: firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files

A buffer overrun flaw exists in the Linux kernel when the strlen function is used on name fields in V1 wmfw files. This issue results in a loss of system availability...

CVE-2024-46639

A cross-site scripting XSS vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box...

CVE-2024-46639

A cross-site scripting XSS vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box...

CVE-2024-46639

A cross-site scripting XSS vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box...