CVE-2025-24320 BIG-IP Configuration utility vulnerability

A stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. This vulnerability is due to an incomplete fix for CVE-2024-31156...

CVE-2024-57433

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. After a user logs out, their token is still available and fetches information in the logged-in state...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the ovsvportsend function not properly checking that the device is in a running state when the device is...

CVE-2024-12709

The Bulk Me Now! WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-12709

The Bulk Me Now! WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2021-3978

creationtimestamp| type| source ---|---|--- 2025-01-29 10:07:48+00:00| seen| https://infosec.exchange/users/cve/statuses/113911088253196556 2025-01-29 11:18:14+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/3372 2025-01-29 13:10:48+00:00| seen|...

CVE-2024-12774

The Altra Side Menu WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary menu via a CSRF attack...

CVE-2024-12436

The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-12436

Technical details beyond the Description are not provided in the supplied documents; monitor for updates on CVE-2024-12436 related to WP Customer Area CSRF vulnerability.

PT-2025-1846 · WordPress · Wp Customer Area

Name of the Vulnerable Software and Affected Versions: WP Customer Area versions 8.2.4 and earlier Description: The issue is related to the lack of CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks. Recommendations: WP Custom...

UBUNTU-CVE-2025-21520

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Options. Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL...

PwnDoc 跨站请求伪造漏洞

PwnDoc is a penetration test report generator from PwnDoc open source. PwnDoc suffers from a cross-site request forgery vulnerability that stems from the lack of cross-site request forgery protection. An attacker exploiting this vulnerability could send GET and POST requests on behalf of a...

CVE-2024-57035

creationtimestamp| type| source ---|---|--- 2025-01-17 20:17:24+00:00| seen| https://infosec.exchange/users/cve/statuses/113845537590313066 2025-01-17 20:21:07+00:00| seen| https://infosec.exchange/users/cve/statuses/113845552210273560 2025-01-17 20:57:58+00:00| published-proof-of-concept|...

CVE-2024-40854

creationtimestamp| type| source ---|---|--- 2025-01-15 19:41:49+00:00| seen| https://infosec.exchange/users/cve/statuses/113834073060185609 2025-01-15 19:55:08+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/1839 2025-01-15 20:15:55+00:00| seen|...

PT-2025-3144 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 11.5.42 ELTS TYPO3 versions prior to 12.4.25 LTS TYPO3 versions prior to 13.4.3 LTS Description: A vulnerability has been identified in the backend user interface functionality involving deep links, which is susceptibl...

SonicWALL SonicOS 安全漏洞

SonicWALL SonicOS is a set of operating systems designed for SonicWall firewall appliances from SonicWALL, Inc. A security vulnerability exists in SonicWall SonicOS that stems from the presence of a server-side request forgery vulnerability. A remote attacker can exploit this vulnerability to...

PLANEX COMMUNICATIONS MZK-DP300N vulnerable to cross-site scripting

Overview MZK-DP300N, wireless LAN router provided by PLANEX COMMUNICATIONS INC., contains a cross-site scripting vulnerability CWE-79. Kentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

CVE-2025-22386

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable...

Optimizely Configured Commerce 安全漏洞

Optimizely Configured Commerce is a combined commerce platform from Optimizely, Inc. A security vulnerability exists in Optimizely Configured Commerce prior to version 5.2.2408, which stems from a vulnerability that allows session tokens bound to logged out sessions to remain active and available...

CVE-2024-11842

The DN Shipping by Weight for WooCommerce WordPress plugin before 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...