2904 matches found
CVE-2024-52415
Cross-Site Request Forgery CSRF vulnerability in skipstorm SK WP Settings Backup sk-wp-settings-backup allows Object Injection.This issue affects SK WP Settings Backup: from n/a through = 1.0...
CVE-2024-51584
CVE-2024-51584 affects the WordPress plugin Marquee Elementor with Posts, specifically versions 1.2.0 and earlier. The issue is DOM-based Cross-Site Scripting caused by improper neutralization of input during web page generation, enabling an attacker to inject script via the plugin’s rendering of...
CVE-2024-51595
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SKSDEV SKSDEV Toolkit sksdev-toolkit allows Stored XSS.This issue affects SKSDEV Toolkit: from n/a through = 1.0.0...
CVE-2024-51603
CVE-2024-51603 affects the WordPress plugin NMR Strava activities up to version 1.0.6. It is a DOM-based XSS caused by improper input neutralization during page generation. Exploitation details are not provided in the documents; success could lead to attacker-supplied script executing in a victim...
CVE-2024-51603 WordPress NMR Strava activities plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mirceatm NMR Strava activities nmr-strava-activities allows DOM-Based XSS.This issue affects NMR Strava activities: from n/a through = 1.0.7...
CVE-2024-51612
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in designerken Reftagger Shortcode reftagger-shortcode allows Stored XSS.This issue affects Reftagger Shortcode: from n/a through = 1.1...
CVE-2024-51712
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michael Visser Jigoshop – Store Toolkit jigoshop-store-toolkit allows Reflected XSS.This issue affects Jigoshop – Store Toolkit: from n/a through = 1.4.0...
CVE-2024-51778 WordPress Satisfaction Reports from Help Scout plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tevya Satisfaction Reports from Help Scout happiness-reports-for-help-scout allows Reflected XSS.This issue affects Satisfaction Reports from Help Scout: from n/a through = 2.0.3...
CVE-2024-51780 WordPress eewee admin custom plugin <= 1.8.2.4 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in eewee eewee admin custom eewee-admincustom allows Reflected XSS.This issue affects eewee admin custom: from n/a through = 1.8.2.4...
CVE-2024-51601 WordPress Website price calculator plugin <= 4.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Maksym Marko Website price calculator price-calculator-to-your-website allows SQL Injection.This issue affects Website price calculator: from n/a through = 4.1...
CVE-2024-51786
CVE-2024-51786 is an XSS vulnerability in the WordPress plugin Realty by BestWebSoft. Affected are Realty by BestWebSoft versions up to 1.1.5 (inclusive). Root cause: improper neutralization of input during web page generation leading to Stored XSS. Impacted contexts can execute scripts in the vi...
SUSE CVE-2024-50183
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Ensure DAID handling completion before deleting an NPIV instance Deleting an NPIV instance requires all fabric ndlps to be released before an NPIV's resources can be torn down. Failure to release fabric ndlps beforeha...
AZL-54074 CVE-2024-50183 affecting package kernel 5.15.200.1-1
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Ensure DAID handling completion before deleting an NPIV instance Deleting an NPIV instance requires all fabric ndlps to be released before an NPIV's resources can be torn down. Failure to release fabric ndlps beforeha...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from improper handling of DAID before NPIV instance deletion...
2N Access Commander 安全漏洞
2N Access Commander is an access control solution from 2N. A security vulnerability exists in 2N Access Commander version 3.1.1.2 and earlier, which stems from a path traversal vulnerability that could allow an attacker with administrative privileges to write to a file on the file system and...
A week in security (October 28 – November 3)
Last week on Malwarebytes Labs: 1,000+ web shops infected by "Phish ‘n Ships" criminals who create fake product listings for in-demand products Android malware FakeCall intercepts your calls to the bank Patch now! New Chrome update for two critical vulnerabilities Update your iPhone, Mac, Watch:...
1,000+ web shops infected by “Phish ‘n Ships” criminals who create fake product listings for in-demand products
Researchers at the Satori Threat Intelligence and Research team have published their findings about a group of cybercriminals that infect legitimate web shops to create and promote fake product listings. The threat, dubbed "Phish ‘n Ships" by the researchers, reportedly infected more than 1,000...
CVE-2024-44052 WordPress HelloAsso plugin <= 1.1.10 - Broken Access Control vulnerability
Missing Authorization vulnerability in HelloAsso HelloAsso helloasso.This issue affects HelloAsso: from n/a through = 1.1.10...
CVE-2024-50423
Templately WordPress plugin
CVE-2024-49663 WordPress uCAT – Next Story plugin <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in elenkadark uCAT – Next Story ucat-next-story allows Reflected XSS.This issue affects uCAT – Next Story: from n/a through = 2.0.0...