CVE-2024-3400: Critical Command Injection Vulnerability in Palo Alto Networks Firewalls

On Friday, April 12, Palo Alto Networks published an advisory on CVE-2024-3400, a CVSS 10 zero-day vulnerability in several versions of PAN-OS, the operating system that runs on the company’s firewalls. According to the vendor advisory, if conditions for exploitability are met, the vulnerability...

WordPress Import Users from CSV Plugin <= 1.2 is vulnerable to PHP Object Injection

Software Import Users from CSV Type Plugin Vulnerable versions = 1.2 Fixed in 1.3 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-32431 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID e3f19c84ef38 Credits Trình Vũ Sonicrrrr from VNPT-VCI Require...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-3272 D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability CVE-2024-3273 D-Link Multiple NAS Devices Command Injection Vulnerability These...

CVE-2024-29220

Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product...

Microsoft Excel Remote Code Execution Vulnerability (CNVD-2024-19332)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A remote code execution vulnerability exists in Microsoft Excel, which can be exploited by an attacker to execute arbitrary code on a system...

WordPress F4 Improvements Plugin <= 1.8.0 is vulnerable to Cross Site Scripting (XSS)

Software F4 Improvements Type Plugin Vulnerable versions = 1.8.0 Fixed in 1.8.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31925 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID adaa81a3b567 Credits Mika Required privilege Administrator...

Chaos RAT XSS to RCE

CHAOS v5.0.8 is a free and open-source Remote Administration Tool that allows generated binaries to control remote operating systems. The webapp contains a remote command execution vulnerability which can be triggered by an authenticated user when generating a new executable. The webapp also...

IBM Security Verify Access Appliance and IBM Application Gateway Information Disclosure Vulnerability

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as the Web, mobile, IoT and cloud using risk-based access, single sign-on, integrated access management controls...

CVE-2024-2834

A Stored Cross-Site Scripting XSS vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could be remotely exploited...

CVE-2024-2834 OpenText ArcSight Management Center and ArcSight Platform Stored XSS

A Stored Cross-Site Scripting XSS vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could be remotely exploited...

WordPress Subscribe To Comments Reloaded Plugin <= 220725 is vulnerable to Sensitive Data Exposure

Software Subscribe To Comments Reloaded Type Plugin Vulnerable versions = 220725 Fixed in 240119 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-31249 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 45c0e6e3acea...

WordPress PostX Plugin <= 3.2.3 is vulnerable to Broken Access Control

Software PostX Type Plugin Vulnerable versions = 3.2.3 Fixed in 3.2.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31246 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 28b8452ef2a5 Credits movrment Required privilege Author...

CISA Known Exploited Vulnerability Catalog March 2024

For a detailed CISAs KEV Catalog, download the pdf file here Summary The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. It is recommended that all organizations review and monitor the KEV catalog,...

WordPress Easy Digital Downloads Plugin <= 3.2.9 is vulnerable to Sensitive Data Exposure

Software Easy Digital Downloads Type Plugin Vulnerable versions = 3.2.9 Fixed in 3.2.10 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-2302 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 4b720db13b09 Credits Colin Xu Required...

CVE-2023-34423

CVE-2023-34423 (Survey Maker) has a stored XSS in versions prior to 3.6.4 that can execute arbitrary scripts in the browser of the admin user logging in to the site. Affected: Survey Maker WordPress plugin

CVE-2024-28895

'Yahoo! JAPAN' App for Android v2.3.1 to v3.161.1 and 'Yahoo! JAPAN' App for iOS v3.2.2 to v4.109.0 contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the WebView of 'Yahoo! JAPAN' App via other app installed on the user's devi...

WordPress List category posts Plugin <= 0.89.6 is vulnerable to Cross Site Scripting (XSS)

Software List category posts Type Plugin Vulnerable versions = 0.89.6 Fixed in 0.89.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1051 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a918041d1b8e Credits Ngô Thiên An ancor...

Technicolor TC8715D Cross-Site Scripting Vulnerability

The Technicolor TC8715D is a wireless router from the French company Technicolor. Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T suffers from a cross-site scripting vulnerability that can be exploited by an attacker to obtain sensitive information such as user cookies...

Inventory Management System Category Name Parameter Cross-Site Scripting Vulnerability

Inventory Management System is an inventory management system. Inventory Management System 20240320 and earlier versions suffer from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by the parameters Category Name/Model...

IBM WebSphere Application Server Liberty Cross-Site Scripting Vulnerability (CNVD-2024-15727)

IBM WebSphere Application Server Liberty is a Java application server from International Business Machines IBM built on top of the Open Liberty project. A cross-site scripting vulnerability exists in IBM WebSphere Application Server Liberty versions 23.0.0.3 through 24.0.0.3, which stems from the...