PT-2024-29324 · Unknown · Kashipara Responsive School Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Responsive School Management System version 3.2.0 Description: An issue was found in the /smsa/admin dashboard.php endpoint, allowing remote unauthenticated attackers to view the administrator dashboard due to incorrect access...

CVE-2024-41246

An Incorrect Access Control vulnerability was found in /smsa/admindashboard.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view administrator dashboard...

GHSA-3CPF-JMMC-8JM3 Concrete CMS vulnerable to Stored Cross-site Scripting

Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board instance functionality. The Name input field does not check the input sufficiently letting a rogue administrator hav the capability to inject malicious JavaScript code. The Concret...

Concrete CMS vulnerable to Stored Cross-site Scripting

Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board instance functionality. The Name input field does not check the input sufficiently letting a rogue administrator hav the capability to inject malicious JavaScript code. The Concret...

CVE-2024-4353 Stored XSS in Generate Board Name Input Field

Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board instance functionality. The Name input field does not check the input sufficiently letting a rogue administrator have the capability to inject malicious JavaScript code. The Concre...

CVE-2024-41961

Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search functionality of the Ruby on Rails based Elektra web application. An authenticated user can craft a search term containing Ruby code, which...

CVE-2024-41961 Elektra vulnerable to remote code execution in universal search

Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search functionality of the Ruby on Rails based Elektra web application. An authenticated user can craft a search term containing Ruby code, which...

CVE-2024-41961 Elektra vulnerable to remote code execution in universal search

Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search functionality of the Ruby on Rails based Elektra web application. An authenticated user can craft a search term containing Ruby code, which...

CVE-2024-41961 Elektra vulnerable to remote code execution in universal search

Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search functionality of the Ruby on Rails based Elektra web application. An authenticated user can craft a search term containing Ruby code, which...

The vulnerability of the Dashboard component of the software control panel allows a hacker to trigger a service failure for IBM App Connect Enterprise applications.

The vulnerability of the Dashboard component of the software integration platform for IBM App Connect Enterprise relates to unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to carry out a DoS Denial-of-Service attack remotely...

PT-2024-30597 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 9.0.0 through 9.3.2 Description: The issue is a stored XSS vulnerability in the generate dashboard board instance functionality. The Name input field does not check the input sufficiently, letting a rogue administrator...

Concrete CMS 跨站脚本漏洞

Concrete CMS is a team-oriented open source content management system from Concrete CMS Open Source. A cross-site scripting vulnerability exists in Concrete CMS versions 9.0.0 through 9.3.2, which stems from being affected by a stored cross-site scripting vulnerability in the Generate Dashboard...

The vulnerability of the Dashboard component of the software control panel allows for the insertion of arbitrary HTML code by attackers, enabling them to implement applications through IBM App Connect Enterprise.

The vulnerability of the Dashboard component of the software platform for integrating IBM App Connect Enterprise applications exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML code remotely...

Empowering WordPress Bug Bounty Hunters: Meet the New Wordfence Bug Bounty Program Researcher Dashboard

Today, we are very excited to announce the launch of our brand-new researcher dashboard for the Wordfence Bug Bounty Program! One frequent request we received from our researchers was to have a way to manage and track all their vulnerability submissions in a single location, and we’re delivering...

CVE-2024-41808 OpenObserve stored XSS vulnerability may lead to complete account takeover

The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log. However, all versions of the platform through 0.9.1 do not sanitize user input in the filter selection menu, which may result in complete account takeover. ...

CVE-2024-41806 Open edX Platform's instructor upload CSV for cohort creation not Private by Default

The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available...

Multi Store Inventory Management System 1.0 Insecure Direct Object Reference

==================================================================================================================================== | Title : Multi Store Inventory Management System v1.0 IDOR Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0....

PT-2024-5257 · Amazon · Aws S3

Name of the Vulnerable Software and Affected Versions: Open edX Platform versions master, palm, olive, nutmeg, maple, lilac, koa, or juniper Description: The issue is related to inadequate access control in the Open edX Platform, specifically with the AWS S3 Bucket Handler component. This may all...

CVE-2024-38725

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Webstix Admin Dashboard RSS Feed allows Stored XSS.This issue affects Admin Dashboard RSS Feed: from n/a through 3.1...

CVE-2024-38725

CVE-2024-38725 describes a stored XSS vulnerability in the WordPress Admin Dashboard RSS Feed plugin. The issue arises from improper input neutralization during web page generation, allowing stored scripts to execute in the context of affected pages. The vulnerability affects Admin Dashboard RSS ...