WordPress If-So Dynamic Content Personalization Plugin < 1.8.0.4 is vulnerable to Cross Site Scripting (XSS)

Software If-So Dynamic Content Personalization Type Plugin Vulnerable versions 1.8.0.4 Fixed in 1.8.0.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6070 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID aeca1edb610d Credits...

CVE-2024-6070 if-so < 1.8.0.4 - Admin+ Stored XSS

The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-5713 if-so < 1.8.0.4 - Reflected XSS

The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

PT-2024-37364 · WordPress · If-So Dynamic Content Personalization

Name of the Vulnerable Software and Affected Versions: If-So Dynamic Content Personalization WordPress plugin versions prior to 1.8.0.4 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html...

The vulnerability in the implementation of the Secure Boot protocol for operating systems with Windows, which allows attackers to circumvent existing security restrictions.

The vulnerability of the Secure Boot protocol for Windows operating systems lies in the overflow of a buffer in dynamic memory. Exploiting this vulnerability could allow an attacker to circumvent existing security restrictions by sending specially crafted data...

Exploit for SQL Injection in Valvepress Automatic

Wordpress SQLI-2-RCE Exploit - This Python script exploits CVE...

ghostscript: OPVP device arbitrary code execution via custom Driver library

A flaw was found in Ghostscript. The "Driver" parameter for the "opvp"/"oprp" device specifies the name of a dynamic library and allows any library to be loaded. This flaw allows a malicious user to send a specially crafted document that, when processed by Ghostscript, could potentially lead to...

PT-2024-4680 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a buffer overflow in dynamic memory in the implementation of the Secure Boot protocol in Windows operating systems. This can be exploited by sending specially crafte...

ifood Order Manager Security Vulnerability

ifood Order Manager is an order manager from ifood. A security vulnerability exists in ifood Order Manager version v3.35.5, which originates from a vulnerability that allows attackers to execute arbitrary code via a DLL hijacking attack...

PT-2024-8348 · Aveva · Aveva Reports For Operations

Name of the Vulnerable Software and Affected Versions: Dream Report versions affected versions not specified AVEVA Reports for Operations versions affected versions not specified Description: The issue is related to errors in processing relative path to directory, which could allow an attacker to...

PT-2024-28343 · Unknown · Ifood Order Manager

Name of the Vulnerable Software and Affected Versions: ifood Order Manager version 3.35.5 Description: An issue in ifood Order Manager allows attackers to execute arbitrary code via a DLL hijacking attack. Recommendations: For ifood Order Manager version 3.35.5, consider restricting access to the...

Important: Red Hat Security Advisory: gvisor-tap-vsock security update

An update for gvisor-tap-vsock is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

RHEL 9 : gvisor-tap-vsock (RHSA-2024:4379)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4379 advisory. A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor and is used to provide networking for...

CVE-2024-39864 Apache CloudStack: Integration API service uses dynamic port when disabled

The CloudStack integration API service allows running its unauthenticated API server usually on port 8096 when configured and enabled via integration.api.port global setting for internal portal integrations and for testing purposes. By default, the integration API service port is disabled and is...

CVE-2024-39864 Apache CloudStack: Integration API service uses dynamic port when disabled

The CloudStack integration API service allows running its unauthenticated API server usually on port 8096 when configured and enabled via integration.api.port global setting for internal portal integrations and for testing purposes. By default, the integration API service port is disabled and is...

CVE-2024-39864

The CVE-2024-39864 issue affects Apache CloudStack's Integration API service. When integration.api.port is set to 0 (default), an improper initialisation causes the unauthenticated integration API server to listen on a random port. An attacker with access to the CloudStack management network coul...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the indexing of arrays beyond the bounds of dynamically sized iterators, leading to UBSAN complaints...

CVE-2024-1182

Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electri...

Mitsubishi Electric MC Works64 Code Issue Vulnerability

Mitsubishi Electric MC Works64 is a data acquisition and monitoring system SCADA from Mitsubishi Electric Japan. A code issue vulnerability exists in Mitsubishi Electric MC Works64, which stems from an uncontrolled search path element vulnerability that allows a local attacker to execute maliciou...

ALPINE-CVE-2024-33871

An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp and oprp devices can have an arbitrary name for a...