CVE-2024-8916

CVE-2024-8916 affects the WordPress plugin Suki Sites Import (WordPress). The vulnerability is a Stored Cross-Site Scripting (XSS) via SVG file uploads caused by insufficient input sanitization and output escaping. It applies to all versions up to and including 1.2.1. The attack requires authenti...

WordPress plugin Suki Sites Import 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Suki Sites Import plugin <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin Suki Sites Import versions = 1.2.1...

PT-2024-39317 · WordPress · Suki Sites Import

Name of the Vulnerable Software and Affected Versions: Suki Sites Import plugin for WordPress versions up to, and including, 1.2.1 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

WordPress Suki Sites Import Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Suki Sites Import Type Plugin Vulnerable versions = 1.2.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8916 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2842aa063ca2 Credits Francesco Carlucci...

Oracle WebCenter Sites (October 2024 CPU)

The 12.2.1.4.0 versions of WebCenter Sites installed on the remote host are affected by a vulnerability as referenced in the October 2024 CPU advisory. - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites jose4j. The supported version that i...

CVE-2024-46911

Cross-site Resource Forgery CSRF, Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content and this combined with a deficiency in Roller's CSRF protections allowed an escalation of privileges...

BIT-DISCOURSE-2024-45051 Bypass of email address validation via encoded email addresses in Discourse

Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed versio...

CVE-2024-47648

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in EventPrime Events EventPrime.This issue affects EventPrime: from n/a through 4.0.4.5...

PT-2024-32706 · Unknown · Eventprime

Name of the Vulnerable Software and Affected Versions: EventPrime versions through 4.0.4.5 Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability. This vulnerability allows an attacker to redirect users to untrusted sites...

Microsoft Detects Growing Use of File Hosting Services in Business Email Compromise Attacks

Microsoft is warning of cyber attack campaigns that abuse legitimate file hosting services such as SharePoint, OneDrive, and Dropbox that are widely used in enterprise environments as a defense evasion tactic. The end goal of the campaigns are broad and varied, allowing threat actors to compromis...

CVE-2024-45051

Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed versio...

CVE-2024-45051 Bypass of email address validation via encoded email addresses in Discourse

Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed versio...

CVE-2024-45051 Bypass of email address validation via encoded email addresses in Discourse

Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed versio...

CVE-2024-45051

CVE-2024-45051 affects Discourse: a vulnerability that lets an attacker bypass domain-based restrictions by using a maliciously crafted (encoded) email address, enabling access to private sites, categories and groups. Connected sources confirm this is a Discourse authorization bypass tied to how ...

CVE-2024-45051 Bypass of email address validation via encoded email addresses in Discourse

Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed versio...

PT-2024-31403 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed version Description: A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories, and/or...

CVE-2024-25702

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in the site configuration which when clicked could potentially execute arbitrary JavaScri...

CVE-2024-25702 BUG-000160599 - Stored XSS in Portal for ArcGIS Web App Builder

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in the site configuration which when clicked could potentially execute arbitrary JavaScri...

Esri Portal For ArcGIS 输入验证错误漏洞

Esri Portal For ArcGIS is a component from Environmental Systems Research Institute Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. An input validation error vulnerability exists in Esri Portal For ArcGIS that stems fr...