CVE-2024-3231

CVE-2024-3231 concerns the Popup4Phone WordPress plugin (versions

CVE-2024-2697 Swift Framework < 2024.0.0 - Contributor+ Stored XSS via Shortcode

The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against...

CVE-2024-2697

The CVE CVE-2024-2697 affects the socialdriver-framework WordPress plugin prior to 2024.0.0. The issue is that shortcode attributes are not validated or escaped before output, enabling Stored XSS by low-privilege users (Contributor) against high-privilege users (admins). The Red Hat entry confirm...

CVE-2024-3641

The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks against admins...

CVE-2024-3643 Newsletter Popup <= 1.2 - List Deletion via CSRF

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in admins perform such action via a CSRF attack...

CVE-2024-3641 Newsletter Popup <= 1.2 - Unauthenticated Stored XSS

The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks against admins...

CVE-2024-3641

The CVE-2024-3641 entry corresponds to the WordPress Newsletter Popup plugin (versions ≤ 1.2). The underlying issue is improper sanitisation/escaping of parameters, enabling unauthenticated stored Cross-Site Scripting (XSS) attacks against admins. Public advisories (NVD/NVD-enriched records, CVE ...

Drupal Cross-Site Scripting (XSS) affecting CKEditor Third-party library

The Drupal project uses the CKEditor, library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal. Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content even without...

Drupal core Cross-Site Scripting (XSS) vulnerabilities

The Drupal project uses the CKEditor, library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal. Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content even without...

SailPoint Identity Security Cloud 安全漏洞

SailPoint Identity Security Cloud is a secure identity platform from SailPoint, Inc. A security vulnerability exists in SailPoint Identity Security Cloud that stems from allowing authenticated administrators to execute user-defined templates as part of an attribute transformation, allowing remote...

PT-2024-32042 · WordPress · Import/Export Users/Customers Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Import and export users and customers plugin for WordPress versions up to, and including, 1.26.6.1 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with administrator...

CVE-2023-50180

An exposure of sensitive system information to an unauthorized control sphere vulnerability CWE-497 in FortiADC version 7.4.1 and below, version 7.2.3 and below, version 7.1.4 and below, version 7.0.5 and below, version 6.2.6 and below may allow a read-only admin to view data pertaining to other...

CVE-2024-3637 Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Admin+ Stored XSS

The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2024-3474

The Wow Skype Buttons WordPress plugin before 4.0.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks...

CVE-2024-3476

The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks...

CVE-2024-3481 Counter Box < 1.2.4 - Counter Deletion via CSRF

The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such deleting counters via CSRF attacks...

CVE-2024-3478

The CVE CVE-2024-3478 affects the WordPress plugin Herd Effects. It explains that the plugin, prior to version 5.2.7, lacks CSRF checks in certain bulk actions, enabling a logged-in attacker to coerce an admin into performing unintended actions (e.g., deleting effects) via CSRF attacks. Public so...

CVE-2024-3475

The CVE-2024-3475 issue concerns the Sticky Buttons WordPress plugin. Connected sources confirm that versions prior to 3.2.4 ship with missing CSRF checks on certain bulk actions, enabling an attacker with admin privileges to cause logged-in admins to perform unwanted actions (e.g., deleting butt...

CVE-2024-3474

CVE-2024-3474 concerns the WordPress plugin Wow Skype Buttons (versions before 4.0.4). The issue is a CSRF vulnerability in certain bulk actions that can let an authenticated, logged-in admin perform unauthorized operations, such as deleting buttons, via crafted requests. Public descriptions in R...

Improper Access Control

Mattermost Server is vulnerable to Improper Access Control. The vulnerability is due to incomplete validation of role changes within team.go, allowing an attacker authenticated as a team admin to promote guests to team admins through crafted HTTP requests...