10295 matches found
CVE-2024-49593
In Advanced Custom Fields ACF before 6.3.9 and Secure Custom Fields before 6.3.6.3 plugins for WordPress, using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload. NOTE: if you wish to use the WP Engine alternative update mechanism for the fr...
WordPress plugin Advanced Custom Fields 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the WordPre...
WordPress Advanced Custom Fields Pro <= 6.3.8 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability
Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Duc Luong Tran in WordPress Plugin Advanced Custom Fields PRO versions = 6.3.8...
WordPress Advanced Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability
Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Duc Luong Tran in WordPress Plugin Advanced Custom Fields versions = 6.3.6.2...
CVE-2024-21266
Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite component: Price List. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Pricing...
CVE-2019-25213
The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive file...
WordPress plugin Advanced Access Manager 路径遍历漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...
PT-2024-33558 · WordPress · Advanced Custom Fields Pro +1
Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields ACF versions prior to 6.3.9 Secure Custom Fields versions prior to 6.3.6.3 Description: The issue allows for the execution of a stored XSS payload when using the Field Group editor to edit one of the plugin's fields in...
WordPress Advanced Custom Fields Plugin <= 6.3.6.2 is vulnerable to Cross Site Scripting (XSS)
Software Advanced Custom Fields Type Plugin Vulnerable versions = 6.3.6.2 Fixed in 6.3.6.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID fb0621a063a9 Credits Duc Luong Tran Required privilege...
CVE-2024-46694
...
CVE-2024-21266
Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite component: Price List. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Pricing...
CVE-2024-21266
Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite component: Price List. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Pricing...
CVE-2024-21266
CVE-2024-21266 affects Oracle E-Business Suite Oracle Advanced Pricing (Price List), versions 12.2.3–12.2.13. Root cause: insufficient authorization due to input validation in Price List, enabling a low-privileged, network-accessive attacker (HTTP) to create, delete, or modify data. Impact aligns...
BEC-ware the phish (part 1). Investigating incidents in M365
TL;DR Review the key artefacts to ensure the best possible telemetry is available in the case of a Business Email Compromise BEC. Keep an eye on data retention, where necessary export or forward data for investigations longer than 30 days. Verify and enable Unified Audit Logging, its free and giv...
PT-2024-7012 · Oracle · Oracle Advanced Pricing
Name of the Vulnerable Software and Affected Versions: Oracle Advanced Pricing component: Price List versions 12.2.3 through 12.2.13 Description: The issue is related to insufficient authorization procedure due to incorrect input validation in the Price List component of Oracle Advanced Pricing,...
PT-2024-10744 · Wordfence +1 · Wordfence +1
Name of the Vulnerable Software and Affected Versions: Advanced Access Manager plugin for WordPress versions up to, and including, 5.9.8.1 Wordfence affected versions not specified Description: The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read d...
CVE-2022-45141
...
VulnCheck KEV: CVE-2019-25213
The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive...
WordPress File Manager Advanced Shortcode 2.3.2 Code Injectin / Shell Upload
============================================================================================================================================= | Title : WordPress File Manager Advanced Shortcode 2.3.2 Code Injection Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser :...