8204 matches found
CVE-2024-36819
MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting XSS. This vulnerability allows malicious users to insert a malicious payload into the "Client Name" input. When a service order from this client is created, the malicious payload is displayed on the administrator and employee...
CVE-2024-36819
MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting XSS. This vulnerability allows malicious users to insert a malicious payload into the "Client Name" input. When a service order from this client is created, the malicious payload is displayed on the administrator and employee...
Improper line feed handling in zenml
A denial of service DoS vulnerability exists in zenml-io/zenml version 0.56.3 due to improper handling of line feed \n characters in component names. When a low-privileged user adds a component through the API endpoint api/v1/workspaces/default/components with a name containing a \n character, it...
CVE-2024-5791
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpid' parameter in all versions up to, and including, 4.4.2 due to missing authorization checks on processAction function, as well as insufficient input...
CVE-2024-5791 Appointment Booking and Online Scheduling <= 4.4.2 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpid' parameter in all versions up to, and including, 4.4.2 due to missing authorization checks on processAction function, as well as insufficient input...
CVE-2024-4477
The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting...
CVE-2024-4477 WP Logs Book <= 1.0.1 - Unauthenticated Stored XSS
The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting...
CVE-2024-4477 WP Logs Book <= 1.0.1 - Unauthenticated Stored XSS
The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting...
CVE-2024-1639
The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey and showAllLicenseKeys functions in all versions up to, and including, 3.0.6. This makes it possible for authenticated attackers, with admi...
CVE-2024-1955
The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warningnoticessettings' function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with contributor acces...
CVE-2024-1955
The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warningnoticessettings' function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with contributor acces...
CVE-2024-1955
CVE-2024-1955 affects the WordPress plugin Hide Dashboard Notifications (up to v1.3). Root cause: missing capability check in the warning_notices_settings function, enabling authenticated attackers with contributor+ rights to modify the plugin’s settings. Impact: unauthorized modification of data...
CVE-2024-1639
CVE-2024-1639 affects License Manager for WooCommerce (WordPress). All versions up to 3.0.7 allow an authenticated admin (contributors, per WooCommerce) to view arbitrary decrypted license keys due to missing capability checks in showLicenseKey() and showAllLicenseKeys(). A referrer nonce check e...
WordPress plugin WP Logs Book security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
WordPress plugin Hide Dashboard Notifications security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in the...
WordPress Hide Dashboard Notifications plugin <= 1.3 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Modification vulnerability
Missing Authorization to Authenticated Contributor+ Plugin Settings Modification vulnerability discovered by Francesco Carlucci in WordPress Plugin Hide Dashboard Notifications versions = 1.3...
WordPress Hide Dashboard Notifications Plugin <= 1.3 is vulnerable to Broken Access Control
Software Hide Dashboard Notifications Type Plugin Vulnerable versions = 1.3 Fixed in 1.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1955 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 47605ad93239 Credits Francesco Carlucci...
@ifanrx/dashboard (>=0.1.1, <=1.3.0), @ithinkdt/editor (>=3.4.11, <=3.5.0) +1 more potentially affected by CVE-2024-38356 via tinymce (>=7.0.1, <=7.1.2)
tinymce NPM version =7.0.1, =0.1.1, =3.4.11, =3.0.7-9, =3.4.0 Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...
@ifanrx/dashboard (>=0.1.1, <=1.3.0), @ithinkdt/editor (>=3.4.11, <=3.5.0) +1 more potentially affected by CVE-2024-38357 via tinymce (>=7.0.1, <=7.1.2)
tinymce NPM version =7.0.1, =0.1.1, =3.4.11, =3.0.7-9, =3.4.0 Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...