CVE-2024-35552

Concretely, CVE-2024-35552 affects idccms v1.35 with a CSRF in the component /admin/infoMove_deal.php?mudi=del&dataType=logo&dataTypeCN. The PT-2024-26538 entry confirms the CSRF flaw in the idccms admin path, enabling unauthorized actions. Remediation guidance from the connected PT entry recomme...

From trust to trickery: Brand impersonation over the email attack vector

Cisco recently developed and released a new feature to detect brand impersonation in emails when adversaries pretend to be a legitimate corporation. Talos has discovered a wide range of techniques threat actors use to embed and deliver brand logos via emails to their victims. Talos is providing n...

idccms 安全漏洞

Net Titanium Technology idcCMS Net Titanium IDC Cloud Management Agent System is a cloud management agent system from China's Net Titanium Technology Net Titanium Technology. A security vulnerability exists in idccms v1.35, which was discovered via the component...

WordPress Logo Slider plugin < 4.0.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Logo Slider versions 4.0.0...

WordPress Logo Slider Plugin < 4.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Logo Slider Type Plugin Vulnerable versions 4.0.0 Fixed in 4.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3288 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e6ccc99c3b05 Credits Krugov Artyom Required privile...

Logo Slider < 4.0.0 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks 1. Using a contributor account, add a Logo Slider using the Shortco...

PT-2024-40382 · Unknown · Endroid/Qr-Code-Bundle

Name of the Vulnerable Software and Affected Versions: endroid/qr-code-bundle versions prior to 3.4.2 Description: The issue arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure through the logo path query parameter. Recommendations: For...

CVE-2024-4809

A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file setting.php. The manipulation of the argument logo leads to unrestricted upload. The attack can be launched...

CVE-2024-4681

A vulnerability, which was classified as critical, was found in Campcodes Legal Case Management System 1.0. Affected is an unknown function of the file /admin/general-setting of the component Setting Handler. The manipulation of the argument favicon/logo leads to unrestricted upload. It is possib...

Open Source Clinic Management System 代码问题漏洞

BigProf Online Clinic Management System is an online clinic management system from BigProf, Inc. A code issue vulnerability exists in Open Source Clinic Management System version 1.0, which stems from the parameter logo in the file setting.php that can lead to unrestricted uploads...

PT-2024-32987 · Sourcecodester · Sourcecodester Open Source Clinic Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Open Source Clinic Management System version 1.0 Description: A critical issue has been found in the SourceCodester Open Source Clinic Management System, affecting an unknown functionality of the file setting.php. The...

CVE-2024-26929

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-26929

...

CVE-2024-26929

CVE-2024-26929 is rejected by its CNA and does not represent an active vulnerability entry.

CVE-2024-3028 Improper Input Validation in mintplex-labs/anything-llm

mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logofilename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the...

CVE-2024-3028

CVE-2024-3028 affects mintplex-labs/anything-llm. The issue is improper input validation in the system-preferences API where manipulating the logo_filename parameter can cause reading of arbitrary files (including .env) and deletion via remove-logo. Root cause: lack of proper sanitization of user...

Easy Logo <= 1.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting

Description The Easy Logo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2024-31086

Cross-Site Request Forgery CSRF vulnerability in Venugopal Change default login logo,url and title allows Cross-Site Scripting XSS.This issue affects Change default login logo,url and title: from n/a through 2.0...

CVE-2024-31086

CVE-2024-31086 is a CSRF-to-XSS vulnerability in the WordPress plugin “Change default login logo-url-and-title” affecting versions up to 2.0. The issue arises from a CSRF flaw that can lead to XSS on login page customization. No vendor-specific remediation or patch details are provided in the con...

WordPress Plugin Change default login logo,url and title 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Change default login...