CVE-2024-29022

CVE-2024-29022 affects Xibo CMS. The issue arises from improper sanitisation of certain request headers stored in session and display tables, enabling a stored XSS that can exfiltrate session IDs and User Agents and potentially hijack active sessions. A malicious script can also be injected into ...

CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

CVE-2024-29023 Session Hijacking via token exposure on the session page in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to hijack a session. Users must be...

CVE-2024-29023 Session Hijacking via token exposure on the session page in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to hijack a session. Users must be...

CVE-2024-29023 Session Hijacking via token exposure on the session page in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to hijack a session. Users must be...

CVE-2024-31293

Cross-Site Request Forgery CSRF vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.6...

CVE-2024-31293

Cross-Site Request Forgery CSRF vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.6...

CVE-2024-31293 WordPress Easy Digital Downloads plugin <= 3.2.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.6...

CVE-2024-31293

CVE-2024-31293 is a CSRF vulnerability in the WordPress plugin Easy Digital Downloads (EDD) affecting EDD versions up to 3.2.6. The description notes a CSRF flaw but does not provide technical details about the vulnerable function, affected endpoints, or the exact root cause. The Connected Docume...

CVE-2024-31293 WordPress Easy Digital Downloads plugin <= 3.2.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.6...

Unspecified Vulnerability in Adobe Commerce (CNVD-2024-19007)

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. A security vulnerability exists in Adobe Commerce that can be exploited by an attacker with elevated privileges to potentially abuse the vulnerability t...

PT-2024-23940 · Unknown · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads versions 3.2.6 and earlier Description: A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the...

WordPress Plugin Easy Digital Downloads 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2024-31293: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.6...

digital-urban.ru Cross Site Scripting vulnerability OBB-3916924

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Digital Publications by Supsystic plugin <= 1.7.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Digital Publications by Supsystic versions = 1.7.7...

Apple Updates Spyware Alert System to Warn Victims of Mercenary Attacks

Apple on Wednesday revised its documentation pertaining to its mercenary spyware threat notification system to mention that it alerts users when they may have been individually targeted by such attacks. It also specifically called out companies like NSO Group for developing commercial surveillanc...

Easy Digital Downloads < 3.2.7 - Cross-Site Request Forgery

Description The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized acti...

WordPress Digital Publications by Supsystic Plugin <= 1.7.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Digital Publications by Supsystic Type Plugin Vulnerable versions = 1.7.7 Fixed in 1.7.8 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32089 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 081e14f200e1 Credits...

Introducing the Digital Footprint Portal

Digital security is about so much more than malware. That wasn’t always the case. When I started Malwarebytes more than 16 years ago, malware was the primary security concern—the annoying pop-ups, the fast-spreading viruses, the catastrophic worms—and throughout our company’s history, Malwarebyte...