The vulnerability of the Query Parameter Handler component in the IBM TXSeries for Multiplatforms transaction management software solutions, including the IBM CICS TX Standard and IBM CICS TX Advanced application servers, allows a malicious individual to gain unauthorized access to confidential information.

The vulnerability of the Query Parameter Handler component in the IBM TXSeries transaction application management software for multiplatforms, as well as in the IBM CICS TX Standard and IBM CICS TX Advanced application servers, is related to the use of an unprotected communication channel for dat...

PT-2024-14816 · WordPress +1 · Advanced Page Visit Counter

Name of the Vulnerable Software and Affected Versions: The Advanced Page Visit Counter WordPress plugin versions prior to 8.0.6 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible even when the unfiltered html...

WordPress Advanced Access Manager Plugin <= 6.9.20 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Access Manager Type Plugin Vulnerable versions = 6.9.20 Fixed in 6.9.21 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29124 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID bab97a68bf4d Credits Delbert Giovanni Lie Require...

WordPress Advanced Access Manager Plugin <= 6.9.20 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Access Manager Type Plugin Vulnerable versions = 6.9.20 Fixed in 6.9.21 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29127 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 31ea026b43aa Credits Rafie Muhammad...

Moderate: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.9.3 security and bug fix container updates

Red Hat Advanced Cluster Management for Kubernetes 2.9.3 General Availability release images, which fix bugs and update container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...

CVE-2024-28390

CVE-2024-28390 affects the Advanced Plugins ultimateimagetool module for PrestaShop prior to version 2.2.01. The issue permits a remote attacker to escalate privileges and access sensitive information due to improper access control in the module. Evidence from multiple sources confirms the vulner...

CVE-2024-27952

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Codeus Advanced Sermons allows Reflected XSS.This issue affects Advanced Sermons: from n/a through 3.2...

CVE-2024-27952

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Codeus Advanced Sermons allows Reflected XSS.This issue affects Advanced Sermons: from n/a through 3.2...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Codeus Advanced Sermons allows Reflected XSS.This issue affects Advanced Sermons: from n/a through 3.2...

CVE-2024-27952 WordPress Advanced Sermons plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Codeus Advanced Sermons allows Reflected XSS.This issue affects Advanced Sermons: from n/a through 3.2...

CVE-2024-27952

CVE-2024-27952 is a reflected XSS in the WordPress plugin Advanced Sermons (WP Codeus) up to version 3.2, caused by improper input neutralization during web page generation. Exploitation requires user interaction; impact is limited to client-side script execution in the context of the affected si...

Join Our Webinar on Protecting Human and Non-Human Identities in SaaS Platforms

Identities are the latest sweet spot for cybercriminals, now heavily targeting SaaS applications that are especially vulnerable in this attack vector. The use of SaaS applications involves a wide range of identities, including human and non-human, such as service accounts, API keys, and OAuth...

Researchers Highlight Google's Gemini AI Susceptibility to LLM Threats

Google's Gemini large language model LLM is susceptible to security threats that could cause it to divulge system prompts, generate harmful content, and carry out indirect injection attacks. The findings come from HiddenLayer, which said the issues impact consumers using Gemini Advanced with Goog...

WordPress Plugin Advanced Sermons Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Advanced Sermons Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Sermons Type Plugin Vulnerable versions = 3.2 Fixed in 3.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27952 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b2bcdc917d74 Credits Le Ngoc Anh Required privilege...

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from IBM MQ

Summary IBM MQ added security fixes around "handling the crafterd URL", "removed clear text for user credentials in trace options" and "improved buffering logic to avoid DoS attack. The IBM MQ which contains above fixes is shipped with IBM MQ Operator and IBM supplied MQ Advanced container images...

The vulnerability of the function `dc_resource_state_copy_construct()` in the `drivers/gpu/drm/amd/display/dc/core/dc_resource.c` file, a video driver for AMD’s Linux operating system, allows a malicious actor to cause a service failure.

The vulnerability of the dcresourcestatecopyconstruct function in the drivers/gpu/drm/amd/display/dc/core/dcresource.c file, a video driver for AMD’s Linux kernel, is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

Design/Logic Flaw

Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity who has access to the router admin panel to conduct a DOM-based stored XSS attack that can fetch remote resources. The payload is executed at index.htmladvancedlocation aka the Device Location page...

Security Bulletin: There are multiple vulnerabilities in the IBM SDK, Java Technology Edition that is shipped with IBM CICS TX Advanced (CVE-2024-20952, CVE-2024-20918, CVE-2024-20921, CVE-2024-20919, CVE-2024-20926, CVE-2024-20945, CVE-2023-33850).

Summary There are multiple vulnerabilities in the IBM SDK, Java Technology Edition that is shipped with IBM CICS TX Advanced CVE-2024-20952, CVE-2024-20918, CVE-2024-20921, CVE-2024-20919, CVE-2024-20926, CVE-2024-20945, CVE-2023-33850. An update to IBM CICS TX Advanced has been released to addre...

PT-2024-22257 · Hitron · Hitron Coda-4582

Name of the Vulnerable Software and Affected Versions: Hitron CODA-4582 2AHKM-CODA4589 version 7.2.4.5.1b8 Description: The issue allows a remote attacker within Wi-Fi proximity, who has access to the router admin panel, to conduct a DOM-based stored XSS attack. This attack can fetch remote...