Huawei EulerOS: Security Advisory for krb5 (EulerOS-SA-2024-2442)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-37163 · WordPress · Cm Pop-Up Banners

Name of the Vulnerable Software and Affected Versions: CM Pop-Up Banners for WordPress versions prior to 1.7.3 Description: The issue allows high privilege users, such as Contributors, to perform Cross-Site Scripting attacks due to the plugin not sanitising and escaping some of its popup fields...

PT-2024-39077

Name of the Vulnerable Software and Affected Versions: LearnPress – WordPress LMS Plugin versions up to, and including, 4.2.7 Description: The issue allows unauthenticated attackers to perform SQL Injection via the c fields parameter of the "/wp-json/lp/v1/courses/archive-course" REST API endpoin...

CVE-2024-8610

A vulnerability classified as problematic has been found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of the file /index.php?page=tenants of the component New Tenant Page. The manipulation of the argument Last Name/First Name/Middle Name leads to cros...

GHSA-28H4-788G-RH42 Craft CMS vulnerable to stored XSS in breadcrumb list and title fields

Summary Multiple Stored XSS can be triggered by the breadcrumb list and title fields with user input. Details 1. In the /admin/categories page, category title isn't sanitized and triggered xss. 2. In the category edit page under the /admin/categories/, category title in breadcrumb list isn't...

CVE-2024-45406 Craft CMS stored XSS in breadcrumb list and title fields

Craft is a content management system CMS. Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input...

CVE-2024-45406

Summary: CVE-2024-45406 affects Craft CMS (5.x). The vulnerability is a stored XSS in breadcrumb list and title fields that can be triggered by user input. This is documented across multiple sources (CVE entries, GHSA advisory, and OSV/NVD mirrors) and is described as a stored XSS impacting Craft...

Online Food Ordering System 跨站脚本漏洞

Online Food Ordering System is an online food ordering system developed by Carlo Montero, an individual developer. A cross-site scripting vulnerability exists in Online Food Ordering System version 2.0, which stems from a cross-site scripting attack due to incorrect manipulation of the First Name...

PT-2024-39131 · Sourcecodester · Sourcecodester Best House Rental Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best House Rental Management System version 1.0 Description: A problem has been found in the New Tenant Page component of the file /index.php?page=tenants. The manipulation of the Last Name, First Name, and Middle Name argument...

CVE-2024-8563

A vulnerability was found in SourceCodester PHP CRUD 1.0. It has been classified as problematic. This affects an unknown part of the file /endpoint/update.php. The manipulation of the argument firstname/middlename/lastname leads to cross site scripting. It is possible to initiate the attack...

PT-2024-39100 · Sourcecodester · Sourcecodester Php Crud

Name of the Vulnerable Software and Affected Versions: SourceCodester PHP CRUD version 1.0 Description: A vulnerability was found in the software, classified as problematic. It affects the file /endpoint/update.php, where the manipulation of the first name, middle name, and last name arguments...

PHP CRUD SQL注入漏洞

PHP CRUD is a PHP-based implementation of add, delete, change and retrieve. A SQL injection vulnerability exists in SourceCodester PHP CRUD version 1.0, which originates from the tblpersonid/firstname/middlename/lastname parameters of the /endpoint/update.php file containing a SQL injection...

CVE-2024-44728

Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email, and contact in /clientdetails/admin/regester.php...

CVE-2024-45429

Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the...

CVE-2024-45429

Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the...

CVE-2024-45429

CVE-2024-45429 is a cross-site scripting vulnerability in the WordPress plugins Advanced Custom Fields and Advanced Custom Fields Pro, affecting versions ≤ 6.3.5. The issue arises when an attacker who has the product’s configured capability privilege stores an arbitrary script in a field label, a...

CVE-2024-45429

Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the...

CVE-2024-45429

Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the...

CVE-2024-44999

In the Linux kernel, the following vulnerability has been resolved: gtp: pull network headers in gtpdevxmit syzbot/KMSAN reported use of uninit-value in getdevxmit 1 We must make sure the IPv4 or Ipv6 header is pulled in skb-head before accessing fields in them. Use pskbinetmaypull to fix this...

WordPress Plugin "Advanced Custom Fields" vulnerable to cross-site scripting

Overview The field labels in WordPress Plugin "Advanced Custom Fields" provided by WP Engine contains a cross-site scripting vulnerability CWE-79. Ryo Sotoyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...