3191 matches found
Sitetweet <= 0.2 - Stored XSS via CSRF
Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack The PoC will be displayed on June 25, 2024, to give users the time to update...
WordPress Pearl Plugin <= 1.3.7 is vulnerable to Broken Access Control
Software Pearl Type Plugin Vulnerable versions = 1.3.7 Fixed in 1.3.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5468 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 816d74377350 Credits Lucio Sá Required privilege...
EazyDocs < 2.5.0 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC The PoC will be displayed on June...
Pixel Update Bulletin—June 2024Stay organized with collectionsSave and categorize content based on your preferences.
The Pixel Update Bulletin contains details of security vulnerabilities and functional improvements affecting supported Pixel devices Google devices. For Google devices, security patch levels of 2024-06-05 or later address all issues in this bulletin and all issues in the June 2024 Android Securit...
KB5039260: Windows Server 2012 Security Update (June 2024)
The remote Windows host is missing security update 5039260. It is, therefore, affected by multiple vulnerabilities - Microsoft Message Queuing MSMQ Remote Code Execution Vulnerability CVE-2024-30080 - DHCP Server Service Denial of Service Vulnerability CVE-2024-30070 - Windows OLE Remote Code...
SUSE: Security Advisory (SUSE-SU-2024:1963-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Sitetweet <= 0.2 - Stored XSS via CSRF
Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack PoC The PoC will be displayed on June 25, 2024, to give users the time to update...
KB5039266: Windows Server 2008 Security Update (June 2024)
The remote Windows host is missing security update 5039266. It is, therefore, affected by multiple vulnerabilities - Microsoft Message Queuing MSMQ Remote Code Execution Vulnerability CVE-2024-30080 - Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability CVE-2024-3007...
KB5039225: Windows 10 LTS 1507 Security Update (June 2024)
The remote Windows host is missing security update 5039225. It is, therefore, affected by multiple vulnerabilities - Microsoft Speech Application Programming Interface SAPI Remote Code Execution Vulnerability CVE-2024-30097 - Windows Remote Access Connection Manager Information Disclosure...
Pixel Watch Security Bulletin—June 2024Stay organized with collectionsSave and categorize content based on your preferences.
The Pixel Watch Security Bulletin contains details of security vulnerabilities affecting Pixel Watch devices Google Devices. For Google devices, security patch levels of 2024-06-05 or later address all applicable issues in the June 2024 Android Security Bulletin and all issues in this bulletin. T...
EazyDocs < 2.5.0 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup The PoC will be displayed on June 25,...
Rank Math SEO < 1.0.219 - Authenticated Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow users with access to the General Settings by default admin, however such access can be given to lower roles via the Role Manager feature of the plugin to perform Stored Cross-Site Scripting attacks even wh...
Security Updates for Microsoft Visual Studio Products (June 2024)
The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by multiple vulnerabilities, including: - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2024-29060, CVE-2024-29187 - A remote code execution...
KB5039211: Windows 10 Version 21H2 / Windows 10 Version 22H2 Security Update (June 2024)
The remote Windows host is missing security update 5039211. It is, therefore, affected by multiple vulnerabilities - Microsoft Speech Application Programming Interface SAPI Remote Code Execution Vulnerability CVE-2024-30097 - Windows Remote Access Connection Manager Information Disclosure...
americanriverurgentcare.com Cross Site Scripting vulnerability OBB-3934343
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
agrarshop-online.com Cross Site Scripting vulnerability OBB-3934321
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
agassac.com Cross Site Scripting vulnerability OBB-3934320
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Quiz And Survey Master < 9.0.2 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC 1. Go to to Quizzes & Surveys 2. Add/edit...
Quiz And Survey Master < 9.0.2 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks 1. Go to to Quizzes & Surveys 2. Add/edit a...
