108851 matches found
WordPress Custom Field Suite plugin <= 2.6.7 - Authenticated Stored Cross-Site Scripting vulnerability
Authenticated Stored Cross-Site Scripting vulnerability discovered by Jack Taylor in WordPress Plugin Custom Field Suite versions = 2.6.7...
CVE-2024-23443
A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack...
"ZOZOTOWN" App for Android fails to restrict custom URL schemes properly
Overview "ZOZOTOWN" App for Android provided by ZOZO, Inc. provides the function to access a URL requested via Custom URL Scheme. The App does not restrict access to the function properly CWE-939 which may be exploited to direct the App to access any sites. Impact A remote attacker may lead a use...
CVE-2024-37881
SiteGuard WP Plugin is vulnerable up to version 1.7.6 because redirects from wp-register.php were not restricted, which may disclose the customized login page path (wp-login.php). This could expose the login URL, enabling targeted access attempts. Remediation: upgrade to SiteGuard WP Plugin 1.7.7...
CVE-2024-35298
Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device. As a result, the user may become a victim of a phishing...
CVE-2024-35298
Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device. As a result, the user may become a victim of a phishing...
CVE-2024-4541 Custom Product List Table <= 3.0.0 - Cross-Site Request Forgery
The Custom Product List Table plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation when modifying products. This makes it possible for unauthenticated attackers to add, delete, bulk edit,...
CVE-2024-4541
The CVE CVE-2024-4541 affects the WordPress plugin Custom Product List Table, vulnerable in all versions up to 3.0.0 due to missing nonce validation when modifying products. This allows unauthenticated attackers to perform actions (add, delete, bulk edit, approve or cancel products) by forging re...
PT-2024-27128 · Prestashop · Custom Links
Name of the Vulnerable Software and Affected Versions: PrestaShop module "Custom links" pk customlinks versions prior to 2.3 Description: The issue allows a guest to perform SQL injection in the "Custom links" module. Specifically, the script ajax.php contains a sensitive SQL call that can be...
PT-2024-26422 · Unknown · Zozotown App For Android
Name of the Vulnerable Software and Affected Versions: ZOZOTOWN App for Android versions prior to 7.39.6 Description: The issue is related to improper authorization in the handler for a custom URL scheme, which allows an attacker to lead a user to access an arbitrary website via another applicati...
WordPress Custom Field Suite Plugin <= 2.6.7 is vulnerable to SQL Injection
Software Custom Field Suite Type Plugin Vulnerable versions = 2.6.7 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-3561 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 5e99e2eccc53 Credits Jack Taylor Required privilege Contributor...
WordPress Custom Field Suite Plugin <= 2.6.7 is vulnerable to PHP Object Injection
Software Custom Field Suite Type Plugin Vulnerable versions = 2.6.7 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-3562 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 4d41dee4d577 Credits Jack Taylor Required privilege...
PrestaShop Security Breach
PrestaShop is an open source e-commerce solution from the American company PrestaShop. The solution provides multiple payment methods, short message alerts and product image scaling. A security vulnerability exists in PrestaShop pkcustomlinks 2.3 and earlier versions, which stems from the presenc...
WordPress Custom Field Suite Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)
Software Custom Field Suite Type Plugin Vulnerable versions = 2.6.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3558 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 16f6a09d2c8e Credits Jack Taylor Required...
JVN#37818611: "ZOZOTOWN" App for Android fails to restrict custom URL schemes properly
"ZOZOTOWN" App for Android provided by ZOZO, Inc. provides the function to access a URL requested via Custom URL Scheme. The App does not restrict access to the function properly CWE-939 which may be exploited to direct the App to access any sites. Impact A remote attacker may lead a user to acce...
ZOZOTOWN Security Vulnerability
ZOZOTOWN is a fashion shopping application from the Japanese company ZOZO. A security vulnerability exists in ZOZOTOWN versions prior to 7.39.6, which stems from improper authorization in the Custom URL Scheme issue handler and allows an attacker to direct a user to an arbitrary website via anoth...
WordPress Custom Product List Table plugin <= 3.0.0 - Cross-Site Request Forgery vulnerability
Cross-Site Request Forgery vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin Custom Product List Table versions = 3.0.0...
WordPress Custom Product List Table Plugin <= 3.0.0 is vulnerable to Cross Site Request Forgery (CSRF)
Software Custom Product List Table Type Plugin Vulnerable versions = 3.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-4541 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 880a62dd6058 Credits Benedictus...
The vulnerability of the Microsoft Visual Studio software development tool lies in the violation of data protection mechanisms, allowing attackers to execute arbitrary code.
The vulnerability of the Microsoft Visual Studio software development tool is related to a breach of data protection mechanisms. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file...
