WordPress plugin Elementor Button Plus 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-35855 · Elementor · Elementor Button Plus

Name of the Vulnerable Software and Affected Versions: Elementor Button Plus versions 1.3.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

Sandboxie 路径遍历漏洞

Sandboxie is sandboxie-plus open source sandbox-based isolation software. Sandboxie suffers from a path traversal vulnerability that originates from an authenticated and unprivileged user having the right to read all files in the sandbox folder C:SandboxUserBxxx that belong to other users created...

Exploit for CVE-2024-21534

POC - CVE-2024-21534 Jsonpath-plus vulnerable to Remote Code E...

WordPress Elementor Button Plus plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Elementor Button Plus versions = 1.3.9...

CVE-2024-10510

The adBuddy+ AdBlocker Detection by NetfunkDesign WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example...

WordPress plugin adBuddy+ (AdBlocker Detection) by NetfunkDesign 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-16331 · Netfunkdesign · Adbuddy+

Name of the Vulnerable Software and Affected Versions: adBuddy+ AdBlocker Detection by NetfunkDesign WordPress plugin versions 1.1.3 and earlier Description: The issue concerns a Stored Cross-Site Scripting attack that can be performed by high-privilege users, such as admins, due to the plugin's...

WordPress StreamWeasels YouTube Integration plugin <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin StreamWeasels YouTube Integration versions = 1.3.6...

WordPress LegalWeb Cloud plugin <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin LegalWeb Cloud versions = 1.1.2...

CVE-2024-52323

Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account...

CVE-2024-52323

Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account...

CVE-2024-52323 Sensitive Data Exposure

Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account...

CVE-2024-52323 Sensitive Data Exposure

Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account...

CVE-2024-52323

The connected sources confirm a vulnerability in ManageEngine Analytics Plus prior to version 6100 where the getOAToken method exposes sensitive tokens for the org-admin account. This allows authenticated users to retrieve tokens and may enable privilege escalation to org-admin resources. Mitigat...

The vulnerability of the Windows Active Directory (AD) management and reporting software Zoho ManageEngine ADAudit Plus lies in the lack of protection for SQL query structures, allowing attackers to execute custom queries and gain access to database table records.

The vulnerability of the Windows Active Directory management and reporting software Zoho ManageEngine ADAudit Plus is related to the lack of protection for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute custom queries and gain access to database table...

PT-2024-35177 · Zohocorp · Manageengine Analytics Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine Analytics Plus versions below 6100 Description: The issue allows authenticated sensitive data exposure, enabling users to retrieve sensitive tokens associated with the org-admin account. This is related to the getOAToken...

The vulnerability of the Windows Active Directory management and reporting software Zoho ManageEngine ADAudit Plus lies in the lack of security measures for SQL query structures. This allows attackers to execute custom queries and gain access to database table records.

The vulnerability of the Windows Active Directory management and reporting software Zoho ManageEngine ADAudit Plus is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute user-defined queries and gain access to...

The vulnerability of the audit settings of the Windows Active Directory management and reporting software Zoho ManageEngine ADAudit Plus allows a perpetrator to execute custom requests and gain access to the database table records.

The vulnerability of the audit settings of the Windows Active Directory management and reporting software Zoho ManageEngine ADAudit Plus relates to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute custom queries and gai...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for Nov 2024

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Process Mining 1.15.0 IF004 Vulnerability Details CVEID:CVE-2024-38821 DESCRIPTION: VMware Tanzu Spring Security could allow a remote attacker to bypass security...