CVE-2024-37536

CVE-2024-37536 is a stored XSS vulnerability in the WordPress plugin Easy Custom Code (Live editing) affecting 1.0.8 and earlier. Exploitation involves the plugin’s Live editing feature, allowing stored XSS without relying on external vectors; remediation is to update to a version later than 1.0....

PT-2024-27634 · Web357 · Web357 Easy Custom Code

Name of the Vulnerable Software and Affected Versions: Web357 Easy Custom Code LESS/CSS/JS – Live editing versions 1.0.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS...

CVE-2024-23794

An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instances when an admin has previously enabled the...

CVE-2024-23794

An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instances when an admin has previously enabled the...

CVE-2024-23794

CVE-2024-23794 affects OTRS and describes an incorrect privilege assignment vulnerability in the inline editing functionality that can enable a read-only agent to gain full access to a ticket when the system configuration’s inline editing setting (AgentFrontend::Ticket::InlineEditing::Property###...

CVE-2024-23794 Agents are able to lock the ticket without the "Owner" permission

An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instances when an admin has previously enabled the...

CVE-2024-23794 Agents are able to lock the ticket without the "Owner" permission

An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instances when an admin has previously enabled the...

CVE-2024-6074 WP eStore < 8.5.5 - Reflected XSS in Customer Editing

The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6076 WP eStore < 8.5.5 - Reflected XSS in Category Editing

The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6074 WP eStore < 8.5.5 - Reflected XSS in Customer Editing

The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6076 WP eStore < 8.5.5 - Reflected XSS in Category Editing

The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6073 WP eStore < 8.5.5 - Reflected XSS in Discount Editing

The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6073 WP eStore < 8.5.5 - Reflected XSS in Discount Editing

The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2024-20090 · Otrs · Otrs

Name of the Vulnerable Software and Affected Versions: OTRS versions 8.0.X OTRS versions 2023.X OTRS versions from 2024.X through 2024.4.x Description: An incorrect privilege assignment vulnerability in the inline editing functionality can lead to privilege escalation. This flaw allows an agent...

CVE-2024-5286 WP Affiliate Platform < 6.5.1 - Reflected XSS via Banner Editing

The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-5283 WP Affiliate Platform < 6.5.1 - Reflected XSS via Lead Editing

The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Siemens SINEMA Remote Connect 安全漏洞

Siemens SINEMA Remote Connect Server is a remote network management platform from Siemens, Germany. The platform is used to remotely access, maintain, control and diagnose the underlying network. Siemens SINEMA Remote Connect Server suffers from a forced browsing vulnerability, which is caused du...

WordPress Easy Custom Code (LESS/CSS/JS) Plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Cronus Patchstack Alliance in WordPress Plugin Easy Custom Code LESS/CSS/JS – Live editing versions = 1.0.8...

Cross Site Scripting (XSS)

drupal/drupal is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the issues in the CKEditor library when configured for WYSIWYG editing, allowing attackers to target users with access to CKEditor, including privileged site admins...

CVE-2024-37344

There is a cross-site scripting vulnerability in the Policy management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with another system administrator’s use of the policy management UI when the administrators are editing the sam...