PT-2024-32434 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.8 Description: The issue allows an attacker to view posts and files of archived channels via file links when viewing archived channels is disabled, due to a failure to properly authorize access to archive...

WordPress Elementor Addons by Livemesh plugin <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piechart_settings Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via piechartsettings Parameter vulnerability discovered by stealthcopter in WordPress Plugin Livemesh Addons for Elementor versions = 8.5...

WordPress Kodex Posts likes plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Kodex Posts likes versions = 2.5.0...

Remote Code Execution

com.alipay.sofa:hessian is vulnerable to Remote Code Execution. The vulnerability is due to a gadget chain that bypasses the SOFA Hessian protocol's blacklist protection mechanism. This gadget chain relies solely on JDK classes and does not require any third-party components. The issue is fixed i...

PT-2024-31646 · Joomunited · Wp Meta Seo

Name of the Vulnerable Software and Affected Versions: JoomUnited WP Meta SEO versions 4.5.13 and earlier Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS. Recommendations: For...

PT-2024-31713 · Pgpool-Ii +2 · Pgpool-Ii +2

Name of the Vulnerable Software and Affected Versions: Pgpool-II versions up to 4.5.3 Description: Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II. If a database user accesses a query cache, table data unauthorized for the user may be retrieved...

WordPress plugin Bit File Manager 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

WordPress plugin DSGVO All in one for WP 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PTC ThingWorx 安全漏洞

PTC ThingWorx is a complete end-to-end technology platform designed for the Industrial Internet of Things IIoT from PTC Corporation, USA. A security vulnerability exists in PTC ThingWorx version v9.5.0 that stems from an insecure direct object reference that allows an attacker to view sensitive...

CVE-2024-43295

Cross-Site Request Forgery CSRF vulnerability in Passionate Programmers B.V. WP Data Access.This issue affects WP Data Access: from n/a through 5.5.7...

WordPress DSGVO All in one for WP plugin <= 4.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin DSGVO All in one for WP versions = 4.5...

WordPress Classic Addons – WPBakery Page Builder plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Classic Addons – WPBakery Page Builder versions = 3.5...

WordPress plugin Favicon Generator 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-41847

Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browse...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost versions 9.5.x through 9.5.7 and 9.10.x through 9.10.0, which stems from a failure to properly implement privilege controls, resulting in the ability to...

bc-java: BouncyCastle vulnerable to a timing variant of Bleichenbacher (Marvin Attack)

A flaw was found in the Bouncy Castle Java cryptography APIs. Affected versions of the org.bouncycastle:bcprov-jdk18on package are vulnerable to Observable Timing Discrepancy via the PKCS1 1.5 and OAEP decryption process a.k.a. Marvin Attack. An attacker can recover cipher-texts via a side-channe...

IBM QRadar Network Packet Capture 安全漏洞

IBM QRadar Network Packet Capture is an optional QRadar appliance from International Business Machines IBM that can be used to store and manage data when no other network packet capture is available. A security vulnerability exists in IBM QRadar Network Packet Capture version 7.5 that stems from ...

PT-2024-9550 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.21 and earlier Description: The issue is related to a DOM-based Cross-Site Scripting XSS vulnerability. It could be exploited by an attacker to execute arbitrary code in the context of the victim's browse...