CVE-2024-10665: Missing Authorization

The Yaad Sarig Payment Gateway For WC plugin for WordPress is vulnerable to unauthorized modification & access of data due to a missing capability check on the yaadpayviewlogcallback and yaadpaydeletelogcallback functions in all versions up to, and including, 2.2.4. This makes it possible for...

PT-2024-33136

Name of the Vulnerable Software and Affected Versions eSoft Planner version 3.24.08271-USA Description The issue allows attackers to view all transactions performed by the company by supplying a crafted web request due to incorrect access control. Recommendations For eSoft Planner version...

eSoft Planner security vulnerabilities

eSoft Planner is a scheduling software for managing sports facilities from eSoft Planner, Inc. A security vulnerability exists in eSoft Planner version 3.24.08271-USA, which stems from improper access control and allows an attacker to view all transactions performed by the company by serving a...

CVE-2024-51906

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ravi Kumar Vanukuru RSV 360 View rsv-360-view allows DOM-Based XSS.This issue affects RSV 360 View: from n/a through = 1.0...

CVE-2024-51906 WordPress RSV 360 View plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ravi Kumar Vanukuru RSV 360 View rsv-360-view allows DOM-Based XSS.This issue affects RSV 360 View: from n/a through = 1.0...

CVE-2024-51906 WordPress RSV 360 View plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ravi Kumar Vanukuru RSV 360 View rsv-360-view allows DOM-Based XSS.This issue affects RSV 360 View: from n/a through = 1.0...

CVE-2024-51906

CVE-2024-51906 concerns a DOM-based XSS in RSV 360 View (WordPress plugin). The RSV 360 View vulnerability is caused by improper input neutralization during web page generation, enabling cross-site scripting. According to PT Security details, affected RSV 360 View versions include n/a through 1.0...

PT-2024-35038 · Unknown · Rsv 360 View

Name of the Vulnerable Software and Affected Versions: RSV 360 View versions n/a through 1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows DOM-Based XSS in RSV 360 View. This type of issue can...

IBM Concert security vulnerability

IBM Concert is a new tool from International Business Machines IBM Inc. that uses generative AI to help manage complex cloud-native applications. IBM Concert suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. A...

CVE-2024-51906: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ravi Kumar Vanukuru RSV 360 View rsv-360-view allows DOM-Based XSS.This issue affects RSV 360 View: from n/a through = 1.0...

WordPress plugin RSV 360: security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-52584

Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs can view or edit the grade for any submission ID, even if they are not a CA for the class that has the submission. The endpoints only check that the CAs hav...

CVE-2021-1234

A vulnerability in the cluster management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. To be affected by this vulnerability, the vManage software must be in cluster mode. This vulnerability is due t...

CVE-2024-9526

There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We...

CVE-2024-9526

There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We...

CVE-2024-9526 Stored XSS in Kubeflow Pipeline View

There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We...

CVE-2024-9526

CVE-2024-9526 describes a stored XSS in Kubeflow Pipeline View web UI. The vulnerability stems from the description field in the pipeline creation form, which allows HTML tags that are not properly filtered, enabling stored cross-site scripting. Multiple sources (NVD entry, SUSE security advisory...

CVE-2024-9526 Stored XSS in Kubeflow Pipeline View

There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We...

UBUNTU-CVE-2024-48896

A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site...

Improper Authorization

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Improper Authorization due to insufficient permission checks in the canview function when accessing report schedules. An attacker can view and potentially manipulate report schedules without proper...