CVE-2024-3961

The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tagsubscriber function in all versions up to, and including, 2.4.9. This makes it possible for...

CVE-2024-1407 Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery to Membership Modification

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing or incorrect nonce validation on multiple functions. This makes it possibl...

CVE-2024-1407: Cross-Site Request Forgery (CSRF)

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing or incorrect nonce validation on multiple functions. This makes it possibl...

CVE-2024-36372

In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible...

CVE-2024-36372

In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible...

CVE-2024-36372

In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible...

EUVD-2024-36040

In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible...

CVE-2024-36372

In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible...

CVE-2024-36372

JetBrains TeamCity is affected by a reflected XSS on the subscriptions page in versions before 2023.05.6. Multiple connected sources (NVD/Nessus/CNVD/CNNVD) describe lack of proper input filtering/escaping on the subscriptions page as the root cause. Practical impact is execution of arbitrary scr...

CVE-2024-36372: Improper Neutralization of Input During Web Page Generation

In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible...

PT-2024-3959

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2023.05.6 Description The issue is related to a reflected XSS vulnerability on the subscriptions page, which could allow a remote attacker to conduct cross-site scripting attacks. This is due to the lack of...

USN-6768-1 glib2.0 vulnerability

Alicia Boya García discovered that GLib incorrectly handled signal subscriptions. A local attacker could use this issue to spoof D-Bus signals resulting in a variety of impacts including possible privilege escalation...

USN-6768-1: GLib vulnerability

Alicia Boya García discovered that GLib incorrectly handled signal subscriptions. A local attacker could use this issue to spoof D-Bus signals resulting in a variety of impacts including possible privilege escalation...

CVE-2024-3215: Cross-Site Request Forgery (CSRF)

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the pmproupdatelevelgrouporder function. Th...

CVE-2024-29320

Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php...

CVE-2024-29320: Improper Neutralization of Special Elements used in an SQL Command

Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php...

CVE-2024-29320

Wallos versions prior to 1.15.3 are vulnerable to an SQL Injection vulnerability. The flaw originates from the improper neutralization of special elements in the category and payment parameters within the /subscriptions/get.php API endpoint. This could allow an attacker to execute unauthorized SQ...

CVE-2024-29320

Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php...

CVE-2024-29320

Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php...

Wallos SQL injection vulnerability

Wallos is an open source personal subscription tracker by the individual developer Miguel Ribeiro. A SQL injection vulnerability exists in Wallos versions prior to 1.15.3, which originates from an easy SQL injection via the category and payment parameters of /subscriptions/get.php...