CVE-2024-30242

Affected product/variant: WordPress plugin “Contact Form to Any API” (versions

CVE-2024-30242 WordPress Contact Form to Any API plugin <= 1.1.8 - Auth. SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in IT Path Solutions Contact Form to Any API.This issue affects Contact Form to Any API: from n/a through 1.1.8...

The vulnerability of the IT services management tool Ivanti Neurons for ITSM lies in its ability to download files of a dangerous type without limitation, allowing an attacker to execute arbitrary commands.

The vulnerability of the IT services management tool Ivanti Neurons for ITSM is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by introducing specially crafted files...

publications.crs4.it Cross Site Scripting vulnerability OBB-3885600

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Infinite loop

Overview org.webjars.bower:markdown-it is a modern pluggable markdown parser. Affected versions of this package are vulnerable to Infinite loop in linkify inline rule when using malformed input. Remediation A fix was pushed into the master branch but not yet published. References - GitHub Diff -...

Distributed Cloud and Edge Computing: A Cheat Sheet for IT Leaders

...

montessori.uniroma3.it Cross Site Scripting vulnerability OBB-3883170

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

immobiliare227.it Cross Site Scripting vulnerability OBB-3882620

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

frida224.it Cross Site Scripting vulnerability OBB-3882393

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

it-tehnik.ru Cross Site Scripting vulnerability OBB-3878931

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-27104

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject t...

CVE-2024-27098

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in version 10.0.13...

CVE-2024-27096

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. This issue has been patched in versi...

CVE-2024-27914 Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI administrator in order to exploit a reflected XSS vulnerability. The XSS will only trigger if...

CVE-2024-27914 Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI administrator in order to exploit a reflected XSS vulnerability. The XSS will only trigger if...

CVE-2024-27914

CVE-2024-27914 affects GLPI (Asset and IT Management Software). The vulnerability is a reflected XSS that can be triggered when an unauthenticated user entices a GLPI administrator with a malicious link and the administrator navigates through the debug bar. The issue is explicitly described as en...

CVE-2024-27104

GLPI contains a stored XSS flaw in the dashboards feature: a user able to create/share dashboards can inject JavaScript, which executes when others open the dashboard. The issue is documented across multiple sources and is mitigated by patching to GLPI version 10.0.13. RISKS and exploit specifics...

CVE-2024-27104 Stored XSS in dashboards in GLPI

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject t...

CVE-2024-27930

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13...

CVE-2024-27098

CVE-2024-27098 concerns GLPI, a Free Asset and IT Management Software. An authenticated user can perform a server-side request forgery (SSRF) via Arbitrary Object Instantiation. The issue affects GLPI prior to the patched version and is mitigated by upgrading to version 10.0.13 or newer. The conn...