CVE-2023-50962 IBM PowerSC information disclosure

IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" HSTS web security policy mechanism. IBM X-Force ID: 276004...

CVE-2023-50962 IBM PowerSC information disclosure

IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" HSTS web security policy mechanism. IBM X-Force ID: 276004...

Easy Digital Downloads < 3.2.7 - Shop Manager+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via the variable pricing option title due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manger-level access, to inject arbitrary web scripts in pages that wi...

CVE-2023-51509

CVE-2023-51509 concerns the WordPress plugin RegistrationMagic (Metagauss)

CVE-2023-52194

CVE-2023-52194 applies to the WordPress plugin “oEmbed Gist” (WordPress oEmbed Gist) up to version 4.9.1. The issue is a Cross-Site Scripting (Stored XSS) vulnerability caused by improper neutralization of input during web page generation. Public references indicate the vulnerability exists in af...

CVE-2024-21750

CVE-2024-21750 affects the WordPress Shortcodes Finder plugin ( 1.5.5 (i.e., 1.5.6 or later) to mitigate exploitation. The connected materials also corroborate the vulnerability’s classification as Cross-Site Scripting and list the affected component as the Shortcodes Finder plugin for WordPress.

CVE-2024-24041

CVE-2024-24041 describes a stored XSS in Travel Journal Using PHP and MySQL with Source Code v1.0, via a crafted payload injected into the location parameter on /travel-journal/write-journal.php. Affected: Travel Journal app v1.0. Impact: could allow arbitrary script execution. Root cause: input ...

CVE-2024-24945

CVE-2024-24945 describes a stored XSS in Travel Journal Using PHP and MySQL with Source Code v1.0. The vulnerability affects the “Share Your Moments” input (endpoint /travel-journal/write-journal.php), where crafted payloads can be stored and executed in a victim’s browser, allowing arbitrary web...

CVE-2024-22153

CVE-2024-22153 affects the WordPress Stock Locations for WooCommerce plugin (

CVE-2024-23502

CVE-2024-23502 applies to WordPress plugin Posts List Designer by Category – List Category Posts Or Recent Posts (InfornWeb) and is a Stored XSS via improper input neutralization during web page generation. Affected versions are listed as n/a through 3.3.2; a fix is available in 3.3.3. PatchStack...

CVE-2023-2439

The CVE-2023-2439 issue affects the WordPress UserPro plugin (version range up to 5.1.5). The root cause is insufficient input sanitization and output escaping on attributes passed to the userpro shortcode, enabling Stored Cross-Site Scripting. The vulnerability requires authentication with contr...

Mozilla: Phishing site popup could show local origin in address bar

The Mozilla Foundation Security Advisory describes this flaw as: A phishing site could have repurposed an about: dialog to show phishing content with an incorrect origin in the address bar...

Mozilla: Phishing site popup could show local origin in address bar

The Mozilla Foundation Security Advisory describes this flaw as: A phishing site could have repurposed an about: dialog to show phishing content with an incorrect origin in the address bar...

Mozilla: Phishing site popup could show local origin in address bar

The Mozilla Foundation Security Advisory describes this flaw as: A phishing site could have repurposed an about: dialog to show phishing content with an incorrect origin in the address bar...

Mozilla: HSTS policy on subdomain could bypass policy of upper domain

The Mozilla Foundation Security Advisory describes this flaw as: In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain...

sunsa.se Cross Site Scripting vulnerability OBB-3845833

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-23782

CVE-2024-23782 is a cross-site scripting vulnerability in a-blog cms affecting: 3.1.x before 3.1.7; 3.0.x before 3.0.29; 2.11.x before 2.11.58; 2.10.x before 2.10.50; and 2.9.0 and earlier. An attacker with contributor or higher privileges can cause arbitrary script execution in a user’s browser....

travelandrvcanada.com Cross Site Scripting vulnerability OBB-3844932

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-23858

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/stockissuancelinecreate.php, in the batchno parameter. Exploitation of this...

CVE-2024-21620 Junos OS: SRX Series and EX Series: J-Web doesn't sufficiently sanitize input to prevent XSS

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an attacker to construct a URL that when visited by another user enables the attacker to execute commands with the target's...