11381 matches found
CVE-2024-2702
CVE-2024-2702 covers Olive One Click Demo Import (Olive Themes) with Missing Authorization that enables importing settings/data and leads to XSS on versions up to 1.1.1. Public sources confirm a patch in 1.1.2. Remediation: upgrade to Olive One Click Demo Import 1.1.2 or apply vendor-provided fix...
CVE-2024-2702 WordPress Olive One Click Demo Import plugin <= 1.1.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Olive Themes Olive One Click Demo Import allows importing settings and data, ultimately leading to XSS.This issue affects Olive One Click Demo Import: from n/a through 1.1.1...
CVE-2024-2702 WordPress Olive One Click Demo Import plugin <= 1.1.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Olive Themes Olive One Click Demo Import allows importing settings and data, ultimately leading to XSS.This issue affects Olive One Click Demo Import: from n/a through 1.1.1...
WordPress Plugin Olive One Click Demo Import Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
PT-2024-21619 · Olive Themes · Olive One Click Demo Import
Name of the Vulnerable Software and Affected Versions: Olive One Click Demo Import versions 1.1.1 and earlier Description: The issue is related to a Missing Authorization vulnerability in Olive Themes Olive One Click Demo Import, which allows importing settings and data. This can ultimately lead ...
WordPress Olive One Click Demo Import Plugin <= 1.1.1 is vulnerable to Broken Access Control
Software Olive One Click Demo Import Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-2702 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID 277d1e4e3b86 Credits Yudistira Arya...
mapXplore - Allow Exporting The Information Downloaded With Sqlmap To A Relational Database Like Postgres And Sqlite
mapXplore is a modular application that imports data extracted of the sqlmap to PostgreSQL or SQLite database. Its main features are: Import of information extracted from sqlmap to PostgreSQL or SQLite for subsequent querying. Sanitized information, which means that at the time of import, it...
BIT-ARTIFACTORY-2024-2247
JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism...
CVE-2024-2247
JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism...
Cross site scripting
JFrog Artifactory versions below 7.77.7, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism...
PT-2024-19440 · Jfrog · Jfrog Artifactory
Name of the Vulnerable Software and Affected Versions: JFrog Artifactory versions prior to 7.77.7 JFrog Artifactory versions prior to 7.82.1 Description: The issue is related to DOM-based cross-site scripting due to improper handling of the import override mechanism. Recommendations: For versions...
JFrog Artifactory Cross-Site Scripting Vulnerability
JFrog Artifactory is an open source, general-purpose Artifact repository manager from Israel's JFrog that supports clustering and high-availability Docker registries, and provides an end-to-end automation solution for tracking artifacts from development to production. A cross-site scripting...
PT-2026-39279
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0 Description The 'POST /api/v1/models/import' endpoint allows users with the workspace.models import permission to overwrite any existing model in the database, regardless of ownership. When an imported model'...
CVE-2024-2298
The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkpimportproduct function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level...
PT-2024-19631 · WordPress · Affiliate-Toolkit – Wordpress Affiliate Plugin
Name of the Vulnerable Software and Affected Versions: The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress versions up to, and including, 3.5.4 Description: The issue is related to a missing capability check on the atkp import product function, allowing authenticated attackers...
CVE-2024-27932 Deno's improper suffix match testing for DENO_AUTH_TOKENS
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An aut...
CVE-2024-27932 Deno's improper suffix match testing for DENO_AUTH_TOKENS
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An aut...
GHSA-5FRW-4RWQ-XHCR Deno's improper suffix match testing for DENO_AUTH_TOKENS
Summary Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for example.com may be sent to notexample.com. Details authtokens.rs uses a simple endswi...
Deno's improper suffix match testing for DENO_AUTH_TOKENS
Summary Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for example.com may be sent to notexample.com. Details authtokens.rs uses a simple endswi...