CVE-2024-28250

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.8 and 1.15.2, In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies Wireguard-eligible traffic that is sent between a node's...

WordPress Better Search Plugin <= 3.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Better Search Type Plugin Vulnerable versions = 3.3.0 Fixed in 3.3.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29142 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8395a45f6b09 Credits Abdi Pranata Required privilege...

CVE-2024-27960

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in I Thirteen Web Solution Email Subscription Popup allows Stored XSS.This issue affects Email Subscription Popup: from n/a through 1.2.20...

CVE-2024-27960: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in I Thirteen Web Solution Email Subscription Popup allows Stored XSS.This issue affects Email Subscription Popup: from n/a through 1.2.20...

WordPress Advanced Access Manager Plugin <= 6.9.20 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Access Manager Type Plugin Vulnerable versions = 6.9.20 Fixed in 6.9.21 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29124 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID bab97a68bf4d Credits Delbert Giovanni Lie Require...

WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.5.0 is vulnerable to Cross Site Scripting (XSS)

Software YITH WooCommerce Product Add-Ons Type Plugin Vulnerable versions = 4.5.0 Fixed in 4.6.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27994 Patch priority Medium CVSS severity Medium 7.1 Developer YITH PSID 8464da6f5a09 Credits Yudistira Arya Required...

OpenText Vertica Management Security Vulnerability

OpenText Vertica Management is a data management solution from OpenText for managing and optimizing enterprise data warehouses. A security vulnerability exists in OpenText Vertica Management that stems from the ease of bypassing via a carefully crafted request...

WordPress WP Calameo Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)

Software WP Calameo Type Plugin Vulnerable versions = 2.1.7 Fixed in 2.1.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29098 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e6c0b84991b1 Credits Ray Wilson Required privilege Contributor...

The vulnerability of the Oracle LDAP Attribute Handler component in the access control solutions from Broadcom and Symantec Identity Manager and Symantec Identity Governance and Administration allows a attacker to execute XSS attacks.

The vulnerability of the Oracle LDAP Attribute Handler component in the access control solutions from Broadcom and Symantec Identity Manager and Symantec Identity Governance and Administration relates to the lack of security measures for the website structure. Exploiting this vulnerability could...

IBM Common Licensing User Enumeration Vulnerability

IBM Common Licensing is a license management solution from International Business Machines IBM. A user enumeration vulnerability exists in IBM Common Licensing version 9.0, which stems from an observable response discrepancy that can be exploited by a local attacker to enumerate usernames...

WordPress Pie Register Plugin <= 3.8.3.2 is vulnerable to Arbitrary File Upload

Software Pie Register Type Plugin Vulnerable versions = 3.8.3.2 Fixed in 3.8.3.3 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-27957 Patch priority High CVSS severity High 10 Developer Claim ownership PSID a371b236f7d1 Credits Rafie Muhammad Patchstack Required...

WordPress Cryptocurrency Widgets – Price Ticker & Coins List Plugin <= 2.6.8 is vulnerable to Broken Access Control

Software Cryptocurrency Widgets – Price Ticker & Coins List Type Plugin Vulnerable versions = 2.6.8 Fixed in 2.6.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-27953 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 036319de798f...

CVE-2024-1751: Improper Neutralization of Special Elements used in an SQL Command

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the questionid parameter in all versions up to, and including, 2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

TIBCO Security Advisory: March 12, 2024 - TIBCO ActiveSpaces - CVE-2024-1137

TIBCO ActiveSpaces Information Leak Vulnerability Original release date: March 12, 2024 Last revised: --- Source: TIBCO Software Inc. Products Affected TIBCO ActiveSpaces - Enterprise Edition versions 4.4.0 through 4.9.0 The following components are affected: Proxy Client Description The componen...

TIBCO Security Advisory: March 12, 2024 - TIBCO FTL - CVE-2024-1138

TIBCO FTL Privilege Escalation Original release date: March 12, 2024 Last revised: --- Source: TIBCO Software Inc. Products Affected TIBCO FTL - Enterprise Edition versions 6.10.1 and below The following component is affected: FTL Server Description The component listed above contains a...

Huawei EulerOS: Security Advisory for subscription-manager (EulerOS-SA-2024-1302)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2024-1233)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Formidable Registration Plugin < 2.12 is vulnerable to Broken Authentication

Software Formidable Registration Type Plugin Vulnerable versions 2.12 Fixed in 2.12 OWASP Top 10 A4: Insecure Design Classification Broken Authentication CVE CVE-2024-1290 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID de229a590aad Credits Scott Kingsley Clark...

CVE-2024-1502: Missing Authorization

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tutordeleteannouncement function in all versions up to, and including, 2.6.1. This makes it possible for authenticated attackers, with...

CVE-2024-1503: Cross-Site Request Forgery (CSRF)

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the erasetutordata function. This makes it possible for unauthenticated...