6709 matches found
CVE-2024-5941
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'handlerequest' function in all versions up to, and including, 3.14.1. This makes it possible for authenticated attackers,...
WordPress plugin GiveWP 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
PT-2024-37256 · WordPress · Givewp
Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform versions up to, and including, 3.14.1 Description: The issue is related to unauthorized access and deletion of data due to a missing capability check on the handle request function. This allow...
CVE-2024-7906
A vulnerability classified as critical was found in DedeBIZ 6.3.0. This vulnerability affects the function getmimetype of the file /admin/dialog/selectimagespost.php of the component Attachment Settings. The manipulation of the argument upload leads to unrestricted upload. The attack can be...
CVE-2024-7906
A vulnerability classified as critical was found in DedeBIZ 6.3.0. This vulnerability affects the function getmimetype of the file /admin/dialog/selectimagespost.php of the component Attachment Settings. The manipulation of the argument upload leads to unrestricted upload. The attack can be...
CVE-2024-7906 DedeBIZ Attachment Settings select_images_post.php get_mime_type unrestricted upload
A vulnerability classified as critical was found in DedeBIZ 6.3.0. This vulnerability affects the function getmimetype of the file /admin/dialog/selectimagespost.php of the component Attachment Settings. The manipulation of the argument upload leads to unrestricted upload. The attack can be...
CVE-2024-7906 DedeBIZ Attachment Settings select_images_post.php get_mime_type unrestricted upload
A vulnerability classified as critical was found in DedeBIZ 6.3.0. This vulnerability affects the function getmimetype of the file /admin/dialog/selectimagespost.php of the component Attachment Settings. The manipulation of the argument upload leads to unrestricted upload. The attack can be...
CVE-2024-27731
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the lack of file type filtering in the file attachment parameter...
CVE-2024-27731
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the lack of file type filtering in the file attachment parameter...
CVE-2024-27731
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the lack of file type filtering in the file attachment parameter...
CVE-2024-27731
CVE-2024-27731 is a Cross Site Scripting vulnerability in Friendica v2023.12. The issue stems from the lack of file type filtering in the file attachment parameter, which could allow a remote attacker to obtain sensitive information. The available documents consistently describe the affected soft...
CVE-2024-43368 Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste
The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for GHSA-qjqp-xr96-cj99. In pull request 1149, sanitation was added for Trix attachments with a text/html content type. However, Trix only checks the...
CLSA-2024-1723494706 Fix of 19 CVEs
CVE-url: https://ubuntu.com/security/CVE-2024-42068 - bpf: Take return from setmemoryro into account with bpfproglockro CVE-url: https://ubuntu.com/security/CVE-2024-42079 - gfs2: Fix NULL pointer dereference in gfs2logflush CVE-url: https://ubuntu.com/security/CVE-2024-42226 - usb: xhci: prevent...
SUSE CVE-2024-42008
A Cross-Site Scripting vulnerability in rcmailactionmailget-run in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header...
DEBIAN-CVE-2024-42008
A Cross-Site Scripting vulnerability in rcmailactionmailget-run in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header...
CVE-2024-42008
A Cross-Site Scripting vulnerability in rcmailactionmailget-run in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header...
UBUNTU-CVE-2024-42008
A Cross-Site Scripting vulnerability in rcmailactionmailget-run in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header...
Roundcube Webmail 安全漏洞
Roundcube Webmail is an open source browser-based open source IMAP client from Roundcube that supports address book management, message searching, spell checking, and more. A security vulnerability exists in Roundcube Webmail version 1.5.7 and earlier and version 1.6.x prior to 1.6.8, which stems...
EUVD-2024-39390
A Cross-Site Scripting vulnerability in rcmailactionmailget-run in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header...