CVE-2024-39324

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions...

aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions...

Cache Poisoning

ezsystems/ezplatform is vulnerable to cache poisoning. The vulnerability is due to the inability to prevent front-controller script inclusion in URLs when using eZ Platform Cloud or within the .platform.app.yaml configuration file. It allows an attacker to manipulate the cache and potentially ser...

Malicious code in sherlock-front (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3013 Malicious code in sherlock-front (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2881 Malicious code in portal-frontend-public (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in mall-front-babel-directive (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2647 Malicious code in mall-front-babel-directive (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-7081 Malicious code in @realty-front/eslint-plugin (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2394 Malicious code in front-locales (npm)

False positive caused by problematic ingestion. --- -= Per source details. Do not edit below this line.=-...

PT-2024-26277 · Unknown · Create A Quote In Frontend + Backend Pro

Name of the Vulnerable Software and Affected Versions: Complete for Create a Quote in Frontend + Backend Pro module versions = 1.0.51 Description: The issue allows attackers to view sensitive information and cause other impacts. This is achieved via methods such as...

WordPress Page Builder Sandwich plugin <= 5.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin Page Builder Sandwich – Front-End Page Builder versions = 5.1.0...

WordPress Page Builder Sandwich plugin <= 5.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin Page Builder Sandwich – Front-End Page Builder versions = 5.1.0...

WordPress Page Builder Sandwich <= 5.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin Page Builder Sandwich – Front-End Page Builder versions = 5.1.0...

PT-2024-26278 · Unknown · Rsi Pdf/Html Catalog Evolution

Name of the Vulnerable Software and Affected Versions: RSI PDF/HTML catalog evolution prestapdf versions = 7.0.0 Description: A SQL injection issue exists, allowing a guest to perform SQL injection via the PrestaPDFProductListModuleFrontController::queryDb function. Recommendations: For versions ...

WordPress Page Builder Sandwich – Front-End Page Builder Plugin <= 5.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Page Builder Sandwich – Front-End Page Builder Type Plugin Vulnerable versions = 5.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37219 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 46d1ca2c63c5 Credits savphill...

WordPress Page Builder Sandwich – Front-End Page Builder Plugin <= 5.1.0 is vulnerable to Broken Access Control

Software Page Builder Sandwich – Front-End Page Builder Type Plugin Vulnerable versions = 5.1.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37218 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 85666c078a9c Credits...

XMB 1.9.12.06 - Stored XSS

Exploit Title: Persistent XSS in XMB 1.9.12.06 Date: 06/12/2024 Exploit Author: Chokri Hammedi Vendor Homepage: https://www.xmbforum2.com/ Software Link: https://www.xmbforum2.com/download/XMB-1.9.12.06.zip Version: 1.9.12.06 Tested on: Windows XP CVE: N/A Vulnerability Details A persistent store...

CVE-2024-5559

CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could cause denial of service, device reboot, or an attacker gaining full control of the relay when a specially crafted reset token is entered into the front panel of the device...

CVE-2024-37161 MeterSphere front-end editor stores XSS vulnerability

MeterSphere is an open source continuous testing platform. Prior to version 1.10.1-lts, the system's step editor stores cross-site scripting vulnerabilities. Version 1.10.1-lts fixes this issue...