CVE-2024-37370

In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application...

CVE-2024-37370

In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application...

PT-2024-6104

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 versions prior to 1.21.3 Description The issue is related to the modification of the plaintext Extra Count field of a confidential GSS krb5 wrap token. This can cause the unwrapped token to appear truncated to the application,...

CVE-2024-5431

The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.25 via the reservationextrafield shortcode parameter. This makes it possible for authenticated...

PT-2024-36191

Name of the Vulnerable Software and Affected Versions: The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress versions up to, and including, 2.2.25 Description: The issue allows authenticated attackers with Contributor-level access and...

CVE-2024-5892: Improper Neutralization of Input During Web Page Generation

The Divi Torque Lite – Divi Theme and Extra Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘supportunfilteredfilesupload’ function in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2024-37227

Name of the Vulnerable Software and Affected Versions: The Divi Torque Lite – Divi Theme and Extra Theme plugin for WordPress versions up to, and including, 3.6.6 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the...

CVE-2024-5646

The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘headersize’ attribute within the Advanced Text Block widget in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-5646

The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘headersize’ attribute within the Advanced Text Block widget in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-5646 Futurio Extra <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Text Block Widget

The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘headersize’ attribute within the Advanced Text Block widget in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-5646

CVE-2024-5646 affects Futurio Extra for WordPress: stored XSS via the header_size field in the Advanced Text Block widget, exploitable by authenticated users with Contributor+ on all versions up to 2.0.5. Patch 2.0.6 fixes the issue; upgrade is required. If patch unavailable in your environment, ...

CVE-2024-5531

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flickr widget in all versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

WordPress Futurio Extra plugin <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Text Block Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Advanced Text Block Widget vulnerability discovered by wesley wcraft in WordPress Plugin Futurio Extra versions = 2.0.5...

CVE-2024-5531 Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flickr widget in all versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2024-5531

CVE-2024-5531 : Ocean Extra (WordPress) is vulnerable to Stored Cross-Site Scripting via the Flickr Widget in all versions up to and including 2.2.8. The root cause is insufficient input sanitization and output escaping on user-supplied widget attributes, allowing an authenticated attacker with c...

CVE-2024-31397

Improper handling of extra values issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to the product with the administrative privilege may be able to cause a denial-of-service DoS condition...

Wordpress Ocean Extra plugin <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Flickr Widget vulnerability discovered by wesley wcraft in WordPress Plugin Ocean Extra versions = 2.2.8...

CVE-2024-31397: Improper Handling of Extra Values

Improper handling of extra values issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to the product with the administrative privilege may be able to cause a denial-of-service DoS condition...

CVE-2024-5646: Improper Neutralization of Input During Web Page Generation

The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘headersize’ attribute within the Advanced Text Block widget in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2024-36506

Name of the Vulnerable Software and Affected Versions Ocean Extra plugin for WordPress versions up to and including 2.2.8 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the Flickr widget, allowing authenticated attackers with...