36732 matches found
CVE-2024-50808
SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe handling of the "notify" variable in adminnotify.php...
BELL-CVE-2024-50159
Bulletin has no description...
PT-2024-34416 · Seacms · Seacms
Name of the Vulnerable Software and Affected Versions: SeaCms version 13.1 Description: The issue is related to a code injection vulnerability in the notification module of the member message notification module in the backend user module. This vulnerability occurs due to the unsafe handling of t...
CVE-2024-50808
SeaCms 13.1 is vulnerable to code injection in the backend user module’s notification flow (member message notification) due to unsafe handling of the notify variable in admin_notify.php. The concrete affected component is the notification module within the backend user area; root cause is improp...
CVE-2024-50808
SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe handling of the "notify" variable in adminnotify.php...
PT-2024-16661 · Amazon · Amazon Web Services
Name of the Vulnerable Software and Affected Versions: Amazon Web Services AWS affected versions not specified Description: The issue allows an authenticated data.all user to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user i...
CVE-2024-50808
SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe handling of the "notify" variable in adminnotify.php...
BELL-CVE-2024-50133
Bulletin has no description...
PT-2024-8000 · Glpi +1 · Glpi +1
Name of the Vulnerable Software and Affected Versions: GLPI versions 0.80 through 10.0.16 Description: The issue is related to a lack of password recovery mechanism in the GLPI system, which can be exploited by a remote attacker to bypass existing security restrictions. An administrator with acce...
CVE-2024-7877
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is...
CVE-2024-7877
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is...
CVE-2024-7877 Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is...
CVE-2024-7877 Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is...
CVE-2024-7877
CVE-2024-7877 concerns the WordPress plugin Appointment Booking Calendar — Simply Schedule Appointments (versions prior to 1.6.7.55). The issue arises from inadequate sanitization/escaping of certain Notification settings, enabling stored Cross-Site Scripting (XSS) by authenticated users with adm...
PT-2024-38653 · WordPress · The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
Name of the Vulnerable Software and Affected Versions: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin versions prior to 1.6.7.55 Description: The issue is related to the lack of sanitization and escaping of some Notification settings in the plugin,...
zero-day
Zero-Day Vulnerabilities in Open-Source Projects This reposi...
Patch now! New Chrome update for two critical vulnerabilities
Google has released an update for its Chrome browser which includes patches for two critical vulnerabilities. The update brings the Stable channel to versions 130.0.6723.91/.92 for Windows and Mac and 130.0.6723.91 for Linux. The easiest way to update Chrome is to allow it to update automatically...
CVE-2024-10377 ESAFENET CDG DecryptApplicationService.java actionPassDecryptApplication1 sql injection
A vulnerability was found in ESAFENET CDG 5. It has been rated as critical. This issue affects the function actionPassDecryptApplication1 of the file /com/esafenet/servlet/client/DecryptApplicationService.java. The manipulation of the argument id leads to sql injection. The attack may be initiate...
CVE-2024-9686
The Order Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nktgnfwsendtestmessage' function in versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to send a test messa...