CVE-2024-8433: Improper Neutralization of Input During Web Page Generation

The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘themehunkmegamenubgimage' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Zyxel VMG8825-T50K Buffer Overflow Vulnerability

The Zyxel VMG8825-T50K is an Internet access device from China's Hopkins Zyxel. The Zyxel VMG8825-T50K suffers from a buffer overflow vulnerability that originates from the USB file share handler improperly restricting operations within the memory buffer range. An authenticated attacker with...

Cisco Small Business WEB Interface Remote Command Execution Vulnerability

Cisco Small Business Routers is a router device from Cisco. A security vulnerability exists in the Cisco Small Business WEB interface, which can be exploited by an authenticated remote attacker with WEB administrative privileges to submit a special request that can be used in a root context to...

Siemens SINEC Security Monitor 参数注入漏洞

SINEC Security Monitor is a modular network security software for passive, non-intrusive, continuous network security monitoring during production processes at customer sites. Siemens SINEC Security Monitor suffers from a parameter injection vulnerability that stems from a failure to properly...

Eugene AdGuard Home 安全漏洞

Eugene AdGuard Home is an open source application from Eugene. Provides web-wide software for blocking ads and tracking. A security vulnerability exists in Eugene AdGuard Home prior to version 0.107.52, which stems from the presence of an arbitrary file read vulnerability that allows an...

CVE-2024-33506: Exposure of Sensitive Information to an Unauthorized Actor

An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.12 and below allows a remote authenticated attacker assigned to an Administrative Domain ADOM to access device summary of unauthorized ADOMs via crafted HTTP...

PT-2024-6774

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions prior to 22.7R2.1 Ivanti Connect Secure version 9.1R18.9 Ivanti Policy Secure versions prior to 22.7R1.1 Description The issue is related to improper input validation in the admin portal, allowing a remote...

CVE-2024-9167: Incorrect Default Permissions

Under specific circumstances, insecure permissions in Ivanti Velocity License Server before version 5.2 allows a local authenticated attacker to achieve local privilege escalation...

CVE-2024-8964: Improper Neutralization of Input During Web Page Generation

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 7.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-9455: Improper Neutralization of Input During Web Page Generation

The WP Cleanup and Basic Functions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...

PT-2024-39052 · WordPress · Phlox

Name of the Vulnerable Software and Affected Versions: Shortcodes and extra features for Phlox theme plugin for WordPress versions up to, and including, 2.16.3 Description: The issue is related to Stored Cross-Site Scripting via the url parameter in the Modern Heading and Icon Picker widgets. Thi...

CVE-2024-9528: Improper Neutralization of Input During Web Page Generation

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form label fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it...

CVE-2023-26771

Taskcafe 0.3.2 is vulnerable to Cross Site Scripting XSS. There is a lack of validation in the filetype when uploading a SVG profile picture with a XSS payload on it. An authenticated attacker can exploit this vulnerability by uploading a malicious picture which will trigger the payload when the...

CVE-2023-26771

Taskcafe 0.3.2 is vulnerable to Cross Site Scripting XSS. There is a lack of validation in the filetype when uploading a SVG profile picture with a XSS payload on it. An authenticated attacker can exploit this vulnerability by uploading a malicious picture which will trigger the payload when the...

CVE-2024-8149

There is a reflected Cross‑Site Scripting XSS vulnerability in Esri Portal for ArcGIS versions 11.1 and 11.2 that may allow a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary JavaScript code in the victim’s...

CVE-2024-25701

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Experience Builder versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in the Experience Builder Embed widget which when loaded could potentially...

CVE-2024-25707

There is a reflected cross site scripting in Esri Portal for ArcGIS 11.1 and below on Windows and Linux x64 allows a remote authenticated attacker with administrative access to supply a crafted string which could potentially execute arbitrary JavaScript code in the their own browser Self XSS. A...

CVE-2024-47651

This vulnerability exists in Shilpi Client Dashboard due to improper handling of multiple parameters in the API endpoint. An authenticated remote attacker could exploit this vulnerability by including multiple “userid” parameters in the API request body leading to unauthorized access of sensitive...

Security Bulletin: IBM App Connect Enterprise toolkit is vulnerable to a local authenticated attacker due to the OKHttp component. (CVE-2023-0833).

Summary IBM App Connect Enterprise toolkit is vulnerable to a local authenticated attacker due to the OKHttp component. CVE-2023-0833. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-0833 DESCRIPTION: Red Hat AMQ-Streams could allow ...

CVE-2024-8519 Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'umloggedin' shortcode in all versions up to, and including, 2.8.6 due to insufficient input...