CVE-2024-8239

The CVE-2024-8239 entry concerns the Starbox WordPress plugin (versions prior to 3.5.3). Affected component: rendering of social media profile URLs in certain contexts (e.g., malicious user profile or pages using the starbox shortcode). Root cause: improper handling/rendering leads to Stored XSS ...

PT-2024-31773 · Unknown · Mantis Bug Tracker

Name of the Vulnerable Software and Affected Versions: Mantis Bug Tracker MantisBT versions prior to 2.26.4 Description: The issue allows an unprivileged, registered user to retrieve information about other users' personal system profiles using a crafted POST request. This can lead to the...

CVE-2024-8239: Improper Neutralization of Input During Web Page Generation

The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles URLs in certain contexts, like the malicious user's profile or pages where the starbox shortcode is used, which may be abused by users with at least the contributor role to conduct Stored XSS attacks...

CVE-2024-45792: Exposure of Sensitive Information to an Unauthorized Actor

Mantis Bug Tracker MantisBT is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. This vulnerability is fixed in 2.26.4...

SolarWinds Serv-U 15.2.0 < 15.2.3

The version of SolarWinds Serv-U installed on the remote host is prior to 15.2.2 HF1. It is, therefore, affected by a vulnerability as referenced in the serv-u1522hf1 advisory. - In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files that include users'...

CVE-2024-8861: Improper Neutralization of Input During Web Page Generation

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.9.3.2 due to incorrect use of the wpksesallowedhtml function, which allows the 'onclick' attribute for certain HTML elements without...

CVE-2023-26689

An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request...

CVE-2023-26689

An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request...

CVE-2023-26689: Incorrect User Management

An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request...

CS-Cart 安全漏洞

CS-Cart is an e-commerce platform from CS-Cart Inc. A security vulnerability exists in CS-Cart version 4.16.1. An attacker exploited the vulnerability to change arbitrary user account profiles via a specially crafted request...

PT-2024-12110 · Unknown · Cs-Cart Multivendor

Name of the Vulnerable Software and Affected Versions: CS-Cart MultiVendor version 4.16.1 Description: An issue in CS-Cart MultiVendor allows attackers to alter arbitrary user account profiles via crafted post requests. Recommendations: For CS-Cart MultiVendor version 4.16.1, consider disabling...

UBUNTU-CVE-2024-46721

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix possible NULL pointer dereference profile-parent-dentsAAFSPROFDIR could be NULL only if its parent is made from createmissingancestors.. and 'ent-old' is NULL in aareplaceprofiles... In that case, it must return an...

CVE-2024-8246

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly restricting what users have access to se...

CVE-2024-8246 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly restricting what users have access to se...

CVE-2024-8246

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress (BuddyForms) has a privilege-escalation vulnerability in all versions up to and including 2.8.11. The root cause is inadequate restriction of what users can ...

CVE-2024-8246 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly restricting what users have access to se...

CVE-2024-8246: Improper Privilege Management

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly restricting what users have access to se...

WordPress plugin Community by PeepSo – Social Network, Membership, Registration, User Profiles 跨站脚本漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin...

CVE-2022-48887

CVE-2022-48887 affects the Linux kernel DRM vmwgfx driver. User-resource lookups previously used RCU paths, which were buggy and could crash when command buffers were submitted from two threads. The fix replaces the RCU-based lookups with a regular spin lock to remove races in accesses to shared ...

CVE-2024-41710

creationtimestamp| type| source ---|---|--- 2024-08-12 21:51:10+00:00| seen| https://t.me/cvedetector/2885 2025-01-29 15:16:45+00:00| seen| https://bsky.app/profile/bluecyber.bsky.social/post/3lgvba3e4e222 2025-01-29 21:02:07+00:00| seen|...