DEBIAN-CVE-2024-49760

OpenRefine is a free, open source tool for working with messy data. The load-language command expects a lang parameter from which it constructs the path of the localization file to load, of the form translations-$LANG.json. But when doing so in versions prior to 3.8.3, it does not check that the...

OpenRefine 安全漏洞

OpenRefine is a Java-based open source tool from OpenRefine Open Source. The product is mainly used for loading data, analyzing data and cleaning data, etc. A security vulnerability exists in OpenRefine prior to version 3.8.3, which stems from the built-in "Something went error!" error page that...

Apache Syncope 跨站脚本漏洞

Apache Syncope is an open source digital identity management system from the Apache USA Foundation for use in enterprise environments. The system supports identity management, role configuration, and more. A cross-site scripting vulnerability exists in Apache Syncope versions 2.1.X through 2.1.14...

CVE-2024-45335

Trend Micro Antivirus One, version 3.10.4 and below contains a vulnerability that could allow an attacker to use a specifically crafted virus to allow itself to bypass and evade a virus scan detection...

Collabtive 安全漏洞

Collabtive is a web-based project management system. The system includes features such as project management, document management and time tracking. A security vulnerability exists in Collabtive version 3.1, which stems from the presence of a cross-site scripting XSS vulnerability that can be...

PT-2024-33187 · Unknown · Collabtive

Name of the Vulnerable Software and Affected Versions: Collabtive version 3.1 Description: The issue concerns Cross-site scripting XSS via the name parameter. This occurs under specific conditions: a when action equals add or action equals edit within the managemilestone.php file, and b when acti...

MUSASI version 3 performing authentication on client-side

Overview MUSASI provided by NEUMANN CO.LTD. is an e-learning system for driving schools. MUSASI version 3 performs authentication within the client-side code CWE-603, and the client in pre-authentication state retrieves the credential information from the server just when a user ID is input. This...

NEUMANN MUSASI 安全漏洞

NEUMANN MUSASI is an "e-learning system" from NEUMANN Japan that allows students to study for driving school road traffic regulations and academic exams. A security vulnerability exists in NEUMANN MUSASI version 3, which arises from improper user authentication that allows a user to retrieve...

CVE-2024-49311

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WisdmLabs Edwiser Bridge allows Stored XSS.This issue affects Edwiser Bridge: from n/a through 3.0.7...

WordPress Photo Gallery Builder plugin <= 3.0 - Broken Access Control to Notice Dismissal vulnerability

Broken Access Control to Notice Dismissal vulnerability discovered by Marek Mikita Patchstack Alliance in WordPress Plugin Photo Gallery Builder versions = 3.0...

WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.0.9 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin The Ultimate WordPress Toolkit – WP Extended versions = 3.0.9...

PT-2024-10623 · WordPress · File Manager

Name of the Vulnerable Software and Affected Versions: File Manager plugin for WordPress versions up to, and including, 3.0 Description: The issue is related to a missing capability check in the /inc/root.php file, which allows unauthenticated attackers to bypass authorization. This enables them ...

CVE-2024-48278

Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to Cross Site Request Forgery CSRF via /edit-profile.php...

WordPress WP 2FA with Telegram plugin <= 3.0 - Two-Factor Authentication Bypass vulnerability

Two-Factor Authentication Bypass vulnerability discovered by István Márton in WordPress Plugin WP 2FA with Telegram versions = 3.0...

PT-2024-11908

Name of the Vulnerable Software and Affected Versions Sassy Social Share plugin for WordPress versions up to, and including, 3.3.3 Description The issue is related to Reflected Cross-Site Scripting via the urls parameter called via the heateor sss sharing count AJAX action due to insufficient inp...

VulnCheck KEV: CVE-2022-4971

The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateorssssharingcount' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Elementor plugin <= 3.24.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt function vulnerability

Authenticated Contributor+ Basic Information Exposure via getimagealt function vulnerability discovered by stealthcopter in WordPress Plugin Elementor Website Builder versions = 3.24.5...

PT-2024-39966 · Webeip · Webeip

Name of the Vulnerable Software and Affected Versions: WebEIP version 3.0 Description: The issue concerns a lack of proper validation of user input, allowing remote attackers with regular privilege to inject SQL commands and potentially read, modify, or delete data stored in the database. The...

PT-2024-39967 · Newtype · Newtype Webeip

Name of the Vulnerable Software and Affected Versions: NewType WebEIP version 3.0 Description: The issue is related to improper validation of user input, allowing a remote attacker with regular privileges to insert JavaScript into specific parameters. This results in a Reflected Cross-site...

WordPress Bridge Core plugin <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Demo Import vulnerability

Missing Authorization to Authenticated Subscriber+ Demo Import vulnerability discovered by István Márton in WordPress Plugin Bridge Core versions = 3.3...