CVE-2024-4753

The WP Secure Maintenance WordPress plugin before 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-4753

CVE-2024-4753 concerns the WP Secure Maintenance WordPress plugin (before 1.7). The issue is that certain settings are not properly sanitized/escaped, which could enable Stored XSS by high-privilege users (e.g., admin), including in multisite deployments where unfiltered_html is restricted. The d...

WordPress plugin WP Secure Maintenance security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2024-5911

An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeated attacks eventually cause the Panorama to enter maintenance mode, which...

CVE-2024-5911

An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeated attacks eventually cause the Panorama to enter maintenance mode, which...

CVE-2024-5911 PAN-OS: File Upload Vulnerability in the Panorama Web Interface

An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeated attacks eventually cause the Panorama to enter maintenance mode, which...

CVE-2024-5911 PAN-OS: File Upload Vulnerability in the Panorama Web Interface

An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeated attacks eventually cause the Panorama to enter maintenance mode, which...

CVE-2024-5911

CVE-2024-5911 affects Palo Alto Networks PAN-OS Panorama web interface via an arbitrary file upload vulnerability accessible to an authenticated read-write administrator. The issue can disrupt system processes and crash Panorama, with repeated attacks potentially forcing maintenance mode requirin...

PAN-OS: File Upload Vulnerability in the Panorama Web Interface

An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeated attacks eventually cause the Panorama to enter maintenance mode, which...

Palo Alto Networks PAN-OS 10.1.x < 10.1.9 / 10.2.x < 10.2.4 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.1.x prior to 10.1.9 or 10.2.x prior to 10.2.4. It is, therefore, affected by a vulnerability. An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator...

CVE-2024-38875

An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets...

Geomys, a blueprint for a sustainable open source maintenance firm

In 2022, I left Google in search of a sustainable approach to open source maintenance. A year later, I was a full-time independent professional open source maintainer. Today I’m announcing the natural progression of that experiment: Geomys,1 a small firm of professional maintainers with a portfol...

The vulnerability of SIMATIC PCS, SIMATIC WinCC Runtime Professional, and SIMATIC WinCC control systems lies in the copying of buffers without checking the size of the input data. This allows a malicious actor to trigger malfunctions during maintenance operations.

The vulnerability of SIMATIC PCS, SIMATIC WinCC Runtime Professional, and SIMATIC WinCC control systems lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability can allow attackers to cause malfunctions in the system’s operations...

CBL Mariner 2.0 Security Update: bind (CVE-2023-6516)

The version of bind installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-6516 advisory. - To keep its cache database efficient, named running as a recursive resolver occasionally attempts to clean up t...

CVE-2024-34594

Exposure of sensitive information in proc file system prior to SMR Jul-2024 Release 1 allows local attackers to read kernel memory address...

WordPress WP Secure Maintenance plugin < 1.7 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Guido Iván García Duva in WordPress Plugin WP Secure Maintenance versions 1.7...

WordPress WP Secure Maintenance Plugin < 1.7 is vulnerable to Cross Site Scripting (XSS)

Software WP Secure Maintenance Type Plugin Vulnerable versions 1.7 Fixed in 1.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4753 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 0805b5b4df9d Credits Guido Iván García Duva...

PT-2024-27126 · Prestashop +1 · Theme Settings +1

Name of the Vulnerable Software and Affected Versions: PrestaShop module "Theme settings" pk themesettings versions = 1.8.8 Description: The issue allows a guest to download a txt file containing collected email addresses when the shop is in maintenance mode, due to a lack of permissions control...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from the American company PrestaShop. The solution provides multiple payment methods, short message alerts and product image scaling. A security vulnerability exists in PrestaShop pkthemesettings version 1.8.8 and prior versions, which stems from...

End of Sale and Renewal for XenServer Standard and Premium Editions

Cloud Software Group has decided to end of sale EOS, and end of renewal EOR XenServer Standard and Premium Edition stand-alone offerings on June 3rd, 2024. This change is designed to simplify our product line and deliver superior value and user experience to our customers. From June 3rd onwards,...