15226 matches found
CVE-2024-11254
CVE-2024-11254 (AMP for WP – Accelerated Mobile Pages, WordPress) Vulnerability: Reflected cross-site scripting via the disqus_name parameter. Affected product: AMP for WP plugin for WordPress. Impact: Unauthenticated attackers can inject arbitrary scripts into pages executed in user browsers whe...
CVE-2024-12395
The WooCommerce Additional Fees On Checkout Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘number’ parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2024-12469 WP BASE Booking of Appointments, Services and Events <= 4.9.1 - Reflected Cross-Site Scripting via status Parameter
The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘status’ parameter in all versions up to, and including, 4.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...
CVE-2024-12356
A critical vulnerability has been discovered in Privileged Remote Access PRA and Remote Support RS products which can allow an unauthenticated attacker to inject commands that are run as a site user...
CVE-2024-12356 Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
A critical vulnerability has been discovered in Privileged Remote Access PRA and Remote Support RS products which can allow an unauthenticated attacker to inject commands that are run as a site user...
CVE-2024-12356
CVE-2024-12356 describes a critical, unauthenticated command injection vulnerability in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS). The issue allows an attacker to inject commands that execute with the site user’s privileges, potentially impacting confidentiality, integrit...
CVE-2024-12356 Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
A critical vulnerability has been discovered in Privileged Remote Access PRA and Remote Support RS products which can allow an unauthenticated attacker to inject commands that are run as a site user...
WordPress plugin SMS for WooCommerce 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
CVE-2024-12356
A critical vulnerability has been discovered in Privileged Remote Access PRA and Remote Support RS products which can allow an unauthenticated attacker to inject commands that are run as a site user. Recent assessments: sfewer-r7 at February 13, 2025 3:54pm UTC reported: Based upon both writing a...
CVE-2024-49775
CVE-2024-49775 affects Siemens Opcenter product line and SIMATIC PCS neo, with a heap-based buffer overflow in the integrated UMC component that could allow unauthenticated remote code execution. Affected versions include Opcenter Execution Foundation, Intelligence, Quality (< V2501.0001, <...
Siemens SIMATIC PCS neo Buffer Overflow Vulnerability
SIMATIC PCS neo is a fully Web-based process control system. A buffer overflow vulnerability exists in Siemens SIMATIC PCS neo, which can be exploited by an unauthenticated, remote attacker to execute arbitrary code...
CVE-2024-12422 Import Eventbrite Events <= 1.7.4 - Reflected Cross-Site Scripting
The Import Eventbrite Events plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...
CVE-2024-28980
Dell RecoverPoint for VMs, versions 6.0.x contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...
CVE-2024-28980
Dell RecoverPoint for VMs, versions 6.0.x contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...
CVE-2024-28980
Dell RecoverPoint for VMs, versions 6.0.x contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...
CVE-2024-28980
Dell RecoverPoint for VMs (versions 6.0.x) is affected by CVE-2024-28980 due to use of a broken or risky cryptographic algorithm in the SSH component. An unauthenticated attacker with remote access could potentially achieve remote code execution. Public documentation references a Dell security ad...
CVE-2024-11986
Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scriptin...
CVE-2024-11986
CVE-2024-11986 involves improper input handling of the Host Header in CrushFTP, allowing an unauthenticated attacker to craft input that is stored in web application logs and can execute when an Administrator views the logs. Connected sources identify CrushFTP as the affected product and note the...
CVE-2024-11986 Stored XSS in CrushFTP
Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scriptin...
CVE-2024-12572
The Hello In All Languages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious...