CVE-2024-51548: Unrestricted Upload of File with Dangerous Type

Dangerous File Upload vulnerabilities allow upload of malicious scripts. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the improper sanitization of HTML elements and attributes. An attacker can inject malicious scripts by exploiting the overridden sanitizer configurations that allow certain HTML5 elements. Note Exploiting...

Horns&Hooves campaign delivers NetSupport RAT and BurnsRAT

Recent months have seen a surge in mailings with lookalike email attachments in the form of a ZIP archive containing JScript scripts. The script files – disguised as requests and bids from potential customers or partners – bear names such as "Запрос цены и предложения от Индивидуального...

Cross-site Scripting (XSS)

sylius/sylius is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper validation of uploaded SVG files, allowing attackers to inject malicious scripts that execute in the user's browser context...

PT-2024-35820

Name of the Vulnerable Software and Affected Versions Silverlight Video Player versions n/a through 1.0 Description The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the Silverlight Video Player. This means an attacker can execute malicious scripts on the...

CVE-2024-38833

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations...

VMware Aria Operations 安全漏洞

VMware Aria Operations is a unified, AI-driven, self-driving IT operations management platform for private, hybrid, and multi-cloud environments from VMware, Inc. A security vulnerability exists in VMware Aria Operations that stems from a malicious actor capable of editing views that could inject...

115cms Cross-Site Scripting Vulnerability

115cms is a multi-module intelligent website building system of Guizhou Forxin Technology 115cms Company in China. 115cms suffers from a cross-site scripting vulnerability that can be exploited by attackers to inject malicious scripts into web pages for execution in other users' browsers...

CVE-2024-10726

The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to inject malicious w...

115cms 代码注入漏洞

115cms is a multi-module intelligent website building system of Guizhou Forxin Technology 115cms Company in China. 115cms suffers from a cross-site scripting vulnerability that can be exploited by attackers to inject malicious scripts into web pages for execution in other users' browsers...

PT-2024-34314

Name of the Vulnerable Software and Affected Versions: Intuitive Design GDReseller versions n/a through 1.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This means that an attacker cou...

PT-2024-35007

Name of the Vulnerable Software and Affected Versions SV Forms versions n/a through 2.0.05 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This enables potential attackers to inject...

PT-2024-34940

Name of the Vulnerable Software and Affected Versions Anant Addons for Elementor versions 1.0.0 through 1.0.5 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for DOM-Based XSS, which can be exploited ...

PT-2024-34928

Name of the Vulnerable Software and Affected Versions Bread & Butter versions n/a through 7.4.857 Description The issue is related to improper neutralization of input during web page generation, which allows DOM-Based XSS. This means that an attacker could potentially inject malicious scripts int...

PT-2024-34297

Name of the Vulnerable Software and Affected Versions: Ancient World Linked Data versions 0.2.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This means that the software do...

PT-2024-34292

Name of the Vulnerable Software and Affected Versions: Adam Skaat Countdown & Clock versions through 2.8.0.9 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-34976

Name of the Vulnerable Software and Affected Versions Digital Zoom Studio Parallaxer versions n/a through 1.00 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This means that an attacker can...

PT-2024-34930

Name of the Vulnerable Software and Affected Versions Moka Get Posts Shortcode versions 1.0 and earlier Description The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting'. This is a DOM-Based XSS vulnerability, which can be...

PT-2024-35060

Name of the Vulnerable Software and Affected Versions Jakir Hasan Blocks Post Grid versions 1.0.3 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could potentially inject...

PT-2024-35048

Name of the Vulnerable Software and Affected Versions Multifox Plus versions 1.1.6 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This enables potential attackers to execute...