CVE-2024-45051 Bypass of email address validation via encoded email addresses in Discourse

Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed versio...

PT-2024-31403 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed version Description: A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories, and/or...

CVE-2024-25702

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in the site configuration which when clicked could potentially execute arbitrary JavaScri...

CVE-2024-25702 BUG-000160599 - Stored XSS in Portal for ArcGIS Web App Builder

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in the site configuration which when clicked could potentially execute arbitrary JavaScri...

Esri Portal For ArcGIS 输入验证错误漏洞

Esri Portal For ArcGIS is a component from Environmental Systems Research Institute Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. An input validation error vulnerability exists in Esri Portal For ArcGIS that stems fr...

Fake Trading Apps Target Victims Globally via Apple App Store and Google Play

A large-scale fraud campaign leveraged fake trading apps published on the Apple App Store and Google Play Store, as well as phishing sites, to defraud victims, per findings from Group-IB. The campaign is part of a consumer investment fraud scheme that's also widely known as pig butchering, in whi...

Fake Disney+ activation page redirects to pornographic scam

A common way to activate digital subscriptions such as Netflix, Prime or Disney+ on a new TV is to visit a website and enter the code seen on your screen. It's much easier than having to authenticate using a remote and typing a username and password. Scammers are creating fake activation pages th...

WordPress Spice Starter Sites plugin <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import vulnerability

Missing Authorization to Unauthenticated Demo Content Import vulnerability discovered by Lucio Sá in WordPress Plugin Spice Starter Sites versions = 1.2.5...

CVE-2024-8430

The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spicestartersitesimportercreater function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to import demo conte...

CVE-2024-8430

CVE-2024-8430 : Spice Starter Sites for WordPress is vulnerable through a missing capability check in spice_starter_sites_importer_creater, affecting all versions up to and including 1.2.5. This enables unauthenticated attackers to import demo content and potentially modify data. Connected source...

WordPress Spice Starter Sites Plugin <= 1.2.5 is vulnerable to Broken Access Control

Software Spice Starter Sites Type Plugin Vulnerable versions = 1.2.5 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-8430 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID ca56217f72c4 Credits Lucio Sá Required privilege...

WordPress plugin Spice Starter Sites 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

PT-2024-39007 · WordPress · Spice Starter Sites

Name of the Vulnerable Software and Affected Versions: Spice Starter Sites plugin for WordPress versions 1.2.5 and earlier Description: The issue allows unauthorized modification of data due to a missing capability check on the spice starter sites importer creater function. This makes it possible...

Necro Android Malware Found in Popular Camera and Browser Apps on Play Store

Altered versions of legitimate Android apps associated with Spotify, WhatsApp, and Minecraft have been used to deliver a new version of a known malware loader called Necro. Kaspersky said some of the malicious apps have also been found on the Google Play Store. They have been cumulatively...

CVE-2024-44003

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in spicethemes Spice Starter Sites allows Reflected XSS.This issue affects Spice Starter Sites: from n/a through 1.2.5...

CVE-2024-44003

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in spicethemes Spice Starter Sites spice-starter-sites allows Reflected XSS.This issue affects Spice Starter Sites: from n/a through = 1.2.5...

CVE-2024-44003 WordPress Spice Starter Sites plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in spicethemes Spice Starter Sites allows Reflected XSS.This issue affects Spice Starter Sites: from n/a through 1.2.5...

CVE-2024-44003 WordPress Spice Starter Sites plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in spicethemes Spice Starter Sites spice-starter-sites allows Reflected XSS.This issue affects Spice Starter Sites: from n/a through = 1.2.5...

CVE-2024-44003

CVE-2024-44003 describes a Reflected Cross‑Site Scripting vulnerability in the WordPress plugin Spice Starter Sites . Affected versions are

mozilla: SelectElements could be shown over another site if popups are allowed

The Mozilla Foundation's Security Advisory: If a site had been granted permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack...