CVE-2024-12153 GDY Modular Content <= 0.9.92 - Reflected Cross-Site Scripting

The GDY Modular Content plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 0.9.92. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-12540

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-54288. Reason: This candidate is a reservation duplicate of CVE-2024-54288. Notes: All CVE users should reference CVE-2024-54288 instead of this candidate. All references and descriptions in this candidate have been...

CVE-2023-47225 WordPress Short URL plugin <= 1.6.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in KaizenCoders Short URL shorten-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Short URL: from n/a through = 1.6.8...

CVE-2024-56352

In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page...

CVE-2024-52593 Missing validation allows spoofed "origin" links in Misskey

Misskey is an open source, federated social media platform.In affected versions missing validation in NoteCreateService.insertNote, ApPersonService.createPerson, and ApPersonService.updatePerson allows an attacker to control the target of any "origin" links such as the "view on remote instance"...

CVE-2024-10880

CVE-2024-10880 affects the WordPress plugin JobBoardWP – Job Board Listings and Submissions (versions

CVE-2021-38134

Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.5.0000...

Smart4Web 安全漏洞

Smart4Web is a content management system from Smart4Web, Inc. A security vulnerability exists in versions prior to Smart4Web v.5.020241004. A remote attacker can exploit this vulnerability to execute arbitrary code via the error parameter in the URL...

CVE-2024-10647

CVE-2024-10647 affects the WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin. It is a Reflected Cross-Site Scripting vulnerability caused by remove_query_arg not being properly escaped in the URL, affecting all versions up to and including 1.9.244. Exploitation is possible by a...

CVE-2024-10647 WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL

The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.9.244. This makes it possible for unauthenticated...

CVE-2024-41673

Decidim is a participatory democracy framework. The version control feature used in resources is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.27.8...

CBL Mariner 2.0 Security Update: php (CVE-2024-5458)

The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-5458 advisory. - In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, due to a code logic error, filtering...

WordPress Pods plugin <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URL vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Pod Form Redirect URL vulnerability discovered by wesley wcraft in WordPress Plugin Pods versions = 3.2.1...

WordPress 3D FlipBook plugin <= 1.15.4 - Authenticated (Author+) Stored Cross-Site Scritping via Bookmark URL vulnerability

Authenticated Author+ Stored Cross-Site Scritping via Bookmark URL vulnerability discovered by Tim Coen in WordPress Plugin 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery versions = 1.15.4...

Design/Logic Flaw

The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will...

CVE-2024-27894 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying

The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will...

CVE-2024-26269

Cross-site scripting XSS vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML...

CVE-2024-21723 [20240202] - Core - Open redirect in installation application

Inadequate parsing of URLs could result into an open redirect...

Spoofing

URL spoofing vulnerability exists in a-blog cms Ver.3.1.0 to Ver.3.1.8. If an attacker sends a specially crafted request, the administrator of the product may be forced to access an arbitrary website when clicking a link in the audit log...

GHSA-MQF8-4CQM-P83X Liferay Portal allows attackers to discover the existence of sites

Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the...