14517 matches found
CVE-2024-32089 WordPress Digital Publications by Supsystic plugin <= 1.7.7 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Supsystic Digital Publications by Supsystic.This issue affects Digital Publications by Supsystic: from n/a through 1.7.7...
A week in security (April 8 – April 14)
Last week on Malwarebytes Labs: How to change your Social Security Number Apple warns people of mercenary attacks via threat notification system How to check if your data was exposed in the AT&T breach Microsoft’s April 2024 Patch Tuesday includes two actively exploited zero-day vulnerabilities H...
PT-2024-24394 · Unknown · Digital Publications By Supsystic
Name of the Vulnerable Software and Affected Versions: Supsystic Digital Publications versions 1.7.7 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user without their knowledge or consent...
CVE-2024-32089: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Supsystic Digital Publications by Supsystic.This issue affects Digital Publications by Supsystic: from n/a through 1.7.7...
CVE-2024-29022
Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...
CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS
Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...
CVE-2024-29022
CVE-2024-29022 affects Xibo CMS. The issue arises from improper sanitisation of certain request headers stored in session and display tables, enabling a stored XSS that can exfiltrate session IDs and User Agents and potentially hijack active sessions. A malicious script can also be injected into ...
CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS
Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...
CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS
Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...
CVE-2024-29023 Session Hijacking via token exposure on the session page in Xibo CMS
Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to hijack a session. Users must be...
CVE-2024-29023 Session Hijacking via token exposure on the session page in Xibo CMS
Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to hijack a session. Users must be...
CVE-2024-29023 Session Hijacking via token exposure on the session page in Xibo CMS
Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to hijack a session. Users must be...
CVE-2024-31293
Cross-Site Request Forgery CSRF vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.6...
CVE-2024-31293
Cross-Site Request Forgery CSRF vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.6...
CVE-2024-31293
CVE-2024-31293 is a CSRF vulnerability in the WordPress plugin Easy Digital Downloads (EDD) affecting EDD versions up to 3.2.6. The description notes a CSRF flaw but does not provide technical details about the vulnerable function, affected endpoints, or the exact root cause. The Connected Docume...
CVE-2024-31293 WordPress Easy Digital Downloads plugin <= 3.2.6 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.6...
CVE-2024-31293 WordPress Easy Digital Downloads plugin <= 3.2.6 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.6...
Unspecified Vulnerability in Adobe Commerce (CNVD-2024-19007)
Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. A security vulnerability exists in Adobe Commerce that can be exploited by an attacker with elevated privileges to potentially abuse the vulnerability t...
PT-2024-23940 · Unknown · Easy Digital Downloads
Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads versions 3.2.6 and earlier Description: A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the...
WordPress Plugin Easy Digital Downloads 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...