WordPress Advanced File Manager plugin <= 5.2.8 - Authenticated (Administrator+) Local JavaScript File Inclusion via fma_locale vulnerability

Authenticated Administrator+ Local JavaScript File Inclusion via fmalocale vulnerability discovered by TANG Cheuk Hei siunam in WordPress Plugin Advanced File Manager versions = 5.2.8...

PT-2024-39184 · WordPress · Advanced File Manager

Name of the Vulnerable Software and Affected Versions: Advanced File Manager plugin for WordPress versions up to, and including, 5.2.8 Description: The Advanced File Manager plugin for WordPress is vulnerable to Local JavaScript File Inclusion via the fma locale parameter. This allows authenticat...

CVE-2024-47069

Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie & privacy settings for the website. Prior to versions 1.16.3 and 2.1.3, the block/locale endpoint does not properly sanitize the user-controlled locale input before including it in the...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the block/locale endpoint due to improper sanitization of the locale parameter. PoC html https://redacted.de/cookiebar/block/dens82w%22%3E%3Cimg%20src%3da%20onerror%3dalert1%3Ew9qt...

Cookie Bar 跨站脚本漏洞

Cookie Bar is an Oveleon open source application for Contao. It allows visitors to define cookies and privacy settings for a website. Cookie Bar suffers from a cross-site scripting vulnerability that stems from the block/locale port not properly clearing the locale parameter, leading to reflected...

PT-2024-32386 · Contao +1 · Contao Open Source Cms +1

Name of the Vulnerable Software and Affected Versions: Oveleon Cookie Bar versions prior to 1.16.3 and 2.1.3 Description: The block/locale endpoint does not properly sanitize the user-controlled locale input before including it in the backend's HTTP response, thereby causing reflected cross-site...

VulnCheck KEV: CVE-2022-24785

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm server users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale...

CVE-2024-6933 LimeSurvey Survey General Settings updatesurveylocalesettings_generalsettings actionUpdateSurveyLocaleSettingsGeneralSettings sql injection

A flaw has been found in LimeSurvey 6.5.14-240624. Affected by this issue is the function actionUpdateSurveyLocaleSettingsGeneralSettings of the file /index.php?r=admin/database/index/updatesurveylocalesettingsgeneralsettings of the component Survey General Settings Handler. This manipulation of...

PT-2024-37971

Name of the Vulnerable Software and Affected Versions LimeSurvey version 6.5.14-240624 Description A critical issue has been found, affecting the function actionUpdateSurveyLocaleSettingsGeneralSettings of the component Survey General Settings Handler, located in the file...

GHSA-8FJ2-587W-5WHR aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records

Improper access control allows editors to remove admin group and locale configuration in Aimeos backend...

aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records

Improper access control allows editors to remove admin group and locale configuration in Aimeos backend...

CVE-2024-39322 aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records

aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13,...

aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records

Improper access control allows editors to remove admin group and locale configuration in Aimeos backend...

PT-2024-28447 · Aimeos · Aimeos/Ai-Admin-Jsonadm

Name of the Vulnerable Software and Affected Versions: aimeos/ai-admin-jsonadm versions prior to 2020.10.13 aimeos/ai-admin-jsonadm versions prior to 2021.10.6 aimeos/ai-admin-jsonadm versions prior to 2022.10.3 aimeos/ai-admin-jsonadm versions prior to 2023.10.4 aimeos/ai-admin-jsonadm versions...

Code Injection

willdurand/js-translation-bundle is vulnerable to Code Injection. The vulnerability is due to a lack of validation of 'locale' parameter in 'Controller.php' file, which allows an attacker to inject javascript code...

Malicious code in active-admin_globalize3_locale_selector (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

curl: Unicode-to-ASCII conversion on Windows can lead to argument injection and more

Vulnerability description not provided...

WordPress EasyAzon plugin <= 5.1.0 - Reflected Cross-Site Scripting via easyazon-cloaking-locale vulnerability

Reflected Cross-Site Scripting via easyazon-cloaking-locale vulnerability discovered by Krzysztof Zając in WordPress Plugin EasyAzon versions = 5.1.0...

CVE-2023-6956

The EasyAzon – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘easyazon-cloaking-locale’ parameter in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2024-15139 · Easyazon · Easyazon

Name of the Vulnerable Software and Affected Versions: EasyAzon – Amazon Associates Affiliate Plugin versions up to, and including, 5.1.0 Description: The issue is related to Reflected Cross-Site Scripting via the easyazon-cloaking-locale parameter due to insufficient input sanitization and outpu...