CVE-2024-26929

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-26929

CVE-2024-26929 is rejected by its CNA and does not represent an active vulnerability entry.

CVE-2024-26929

...

CVE-2024-3028 Improper Input Validation in mintplex-labs/anything-llm

mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logofilename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the...

CVE-2024-3028

CVE-2024-3028 affects mintplex-labs/anything-llm. The issue is improper input validation in the system-preferences API where manipulating the logo_filename parameter can cause reading of arbitrary files (including .env) and deletion via remove-logo. Root cause: lack of proper sanitization of user...

Easy Logo <= 1.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting

Description The Easy Logo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2024-31086

Cross-Site Request Forgery CSRF vulnerability in Venugopal Change default login logo,url and title allows Cross-Site Scripting XSS.This issue affects Change default login logo,url and title: from n/a through 2.0...

CVE-2024-31086

CVE-2024-31086 is a CSRF-to-XSS vulnerability in the WordPress plugin “Change default login logo-url-and-title” affecting versions up to 2.0. The issue arises from a CSRF flaw that can lead to XSS on login page customization. No vendor-specific remediation or patch details are provided in the con...

WordPress Plugin Change default login logo,url and title 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Change default login...

CVE-2024-32083

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Varun Kumar Easy Logo allows Stored XSS.This issue affects Easy Logo: from n/a through 1.9.3...

CVE-2024-32083 WordPress Easy Logo plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Varun Kumar Easy Logo allows Stored XSS.This issue affects Easy Logo: from n/a through 1.9.3...

CVE-2024-32083

CVE-2024-32083 affects the Easy Logo WordPress plugin (Varun Kumar Easy Logo). It is a Stored XSS vulnerability caused by improper neutralization of input during web page generation, affecting Easy Logo versions up to 1.9.3. The entry indicates the issue is unpatched; no public remediation is doc...

CVE-2024-32083 WordPress Easy Logo plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Varun Kumar Easy Logo allows Stored XSS.This issue affects Easy Logo: from n/a through 1.9.3...

WordPress Easy Logo plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Cronus Patchstack Alliance in WordPress Plugin Easy Logo versions = 1.9.3...

PT-2024-24388 · Varun Kumar · Easy Logo

Name of the Vulnerable Software and Affected Versions: Varun Kumar Easy Logo versions 1.9.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables attackers to inject...

WordPress Easy Logo Plugin <= 1.9.3 is vulnerable to Cross Site Scripting (XSS)

Software Easy Logo Type Plugin Vulnerable versions = 1.9.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32083 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ab618ce8f1b6 Credits Cronus Required privilege Administrator...

WordPress Plugin Easy Logo 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

CVE-2024-3025 Path Traversal in mintplex-labs/anything-llm

mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. Attackers can exploit this vulnerability by manipulating the logo filename to reference files outside of the restricted directory. This can...

CVE-2024-3025 Path Traversal in mintplex-labs/anything-llm

mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. Attackers can exploit this vulnerability by manipulating the logo filename to reference files outside of the restricted directory. This can...

CVE-2024-3025

The CVE-2024-3025 entry affects mintplex-labs/anything-llm, where the logo filename handling allows path traversal due to insufficient input validation. Attackers can reference files outside the restricted directory via the logo upload endpoint, exposing the application’s database and potentially...