WordPress Sunshine Photo Cart Plugin <= 3.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Sunshine Photo Cart Type Plugin Vulnerable versions = 3.2.5 Fixed in 3.2.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43971 Patch priority Medium CVSS severity Medium 7.1 Developer WP Sunshine PSID abc8080f12fe Credits Le Ngoc Anh Required privilege...

WordPress Sunshine Photo Cart plugin <= 3.2.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Manab Jyoti Dowarah Patchstack Alliance in WordPress Plugin Sunshine Photo Cart versions = 3.2.1...

WordPress Sunshine Photo Cart Plugin <= 3.2.1 is vulnerable to Broken Access Control

Software Sunshine Photo Cart Type Plugin Vulnerable versions = 3.2.1 Fixed in 3.2.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43136 Patch priority Low CVSS severity Low 4.3 Developer WP Sunshine PSID e9fdd2719690 Credits Manab Jyoti Dowarah Required...

sunshinecoastwalks.com Cross Site Scripting vulnerability OBB-3934016

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-31226

Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named C:\Program.exe, C:\Program.bat, or C:\Program.cmd on the user's computer. This...

CVE-2024-31226 Sunshine's unquoted executable path could lead to hijacked execution flow

Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named C:\Program.exe, C:\Program.bat, or C:\Program.cmd on the user's computer. This...

CVE-2024-31226 Sunshine's unquoted executable path could lead to hijacked execution flow

Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named C:\Program.exe, C:\Program.bat, or C:\Program.cmd on the user's computer. This...

CVE-2024-31226

Sunshine (Moonlight’s self-hosted game stream host) for Windows is affected in versions 0.17.0–0.22.2 when running as a service. An attacker could place a file named C:\Program.exe, C:\Program.bat, or C:\Program.cmd on the target machine and trigger hijacked execution flow during service terminat...

Sunshine 安全漏洞

Sunshine is a Moonlight self-hosted live game host. A security vulnerability exists in Sunshine versions 0.17.0 through 0.22.2 that stems from improperly managed access rights...

PT-2024-23867 · Microsoft · Windows +3

Name of the Vulnerable Software and Affected Versions: Sunshine versions 0.17.0 through 0.22.2 Description: Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine as a service on Windows may be impacted when terminating the service if an attacker placed a file named...

Sunshine Photo Cart: Free Client Photo Galleries for Photographers < 3.1.2 - Unauthenticated PHP Object Injection

Description The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-31221

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI interface and then pairing only one device, all of the previously devices will be temporarily paired. Version 0.23.0 contains a patch for the...

CVE-2024-31221 Clients removed during unpairing process may regain access if Sunshine was not restarted

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI interface and then pairing only one device, all of the previously devices will be temporarily paired. Version 0.23.0 contains a patch for the...

CVE-2024-31221 Clients removed during unpairing process may regain access if Sunshine was not restarted

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI interface and then pairing only one device, all of the previously devices will be temporarily paired. Version 0.23.0 contains a patch for the...

CVE-2024-31221

CVE-2024-31221 affects Sunshine, a self-hosted game stream host for Moonlight. Reports across multiple sources indicate that versions 0.10.0 through 0.22.x are vulnerable: after unpairing all devices via the web UI and then pairing a single device, previously paired devices may be temporarily re-...

PT-2024-23863 · Sunshine · Sunshine

Name of the Vulnerable Software and Affected Versions: Sunshine versions 0.10.0 through 0.22.x Description: The issue affects Sunshine, a self-hosted game stream host for Moonlight. After unpairing all devices in the web UI interface and then pairing only one device, all of the previously paired...

Sunshine 安全漏洞

Sunshine is a Moonlight self-hosted live game host. A security vulnerability exists in Sunshine version 0.10.0 up to and including version 0.23.0, which stems from the fact that after unpairing all devices in the Web UI interface, and then after pairing only one device, all previous devices are...

CVE-2024-31220 Sunshine vulnerable to remote unauthenticated arbitrary file read

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read arbitrary files without authentication due to a path traversal vulnerability. Users who exposed the Sunshine configuration web user interface...

CVE-2024-31220 Sunshine vulnerable to remote unauthenticated arbitrary file read

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read arbitrary files without authentication due to a path traversal vulnerability. Users who exposed the Sunshine configuration web user interface...

CVE-2024-31220 Sunshine vulnerable to remote unauthenticated arbitrary file read

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read arbitrary files without authentication due to a path traversal vulnerability. Users who exposed the Sunshine configuration web user interface...