Exploit for Use of Hard-coded Credentials in Solarwinds Web_Help_Desk

CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential...

PT-2024-39067 · WordPress · Themesflat Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Themesflat Addons For Elementor plugin for WordPress versions up to, and including, 2.2.1 Description: The issue is related to Stored Cross-Site Scripting XSS due to insufficient input sanitization and output escaping on URL attributes in...

Exploit for Command Injection in Qualitor

CVE-2023-47253 CVE-2023-47253 | Qualitor = 8.20 RCE De...

protobuf-java has potential Denial of Service issue

Summary When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash. Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team Affected versions: This issue affects all versions of both t...

CVE-2024-44002

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in PickPlugins Team Showcase allows Reflected XSS.This issue affects Team Showcase: from n/a through 1.22.25...

CVE-2024-44002

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins Team Showcase team allows Reflected XSS.This issue affects Team Showcase: from n/a through = 1.22.25...

CVE-2024-44002 WordPress Team Showcase plugin <= 1.22.25 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins Team Showcase team allows Reflected XSS.This issue affects Team Showcase: from n/a through = 1.22.25...

CVE-2024-44002

The CVE-2024-44002 entry concerns the WordPress Team Showcase plugin (Team Showcase) and is a Reflected Cross-Site Scripting (XSS) vulnerability in versions 1.22.25 and earlier. The vulnerability stems from improper input neutralization during web page generation, enabling a reflected XSS conditi...

CVE-2024-43985 WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in MagePeople Team Bus Ticket Booking with Seat Reservation allows Stored XSS.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.3.5...

CVE-2024-8660 Stored XSS in the "Top Navigator Bar" block

Concrete CMS versions 9.0.0 through 9.3.3 are affected by a stored XSS vulnerability in the "Top Navigator Bar" block. Since the "Top Navigator Bar" output was not sufficiently sanitized, a rogue administrator could add a malicious payload that could be executed when targeted users visited the ho...

CVE-2024-8660 Stored XSS in the "Top Navigator Bar" block

Concrete CMS versions 9.0.0 through 9.3.3 are affected by a stored XSS vulnerability in the "Top Navigator Bar" block. Since the "Top Navigator Bar" output was not sufficiently sanitized, a rogue administrator could add a malicious payload that could be executed when targeted users visited the ho...

Rapid7 Introduces Vector Command, a New Managed Service for Continuous Red Teaming

Rapid7 is delighted to announce the launch of Vector Command, a continuous red teaming managed service designed to assess your external attack surface and identify gaps in the security defenses on an ongoing basis. Following the launch of Surface Command and Exposure Command in August, Vector...

WordPress plugin Team Showcase 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Exploit for OS Command Injection in Ivanti Cloud_Services_Appliance

CVE-2024-8190: Ivanti Cloud Service Appliance Authenticated Co...

WordPress Team Showcase plugin <= 1.22.25 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin Team Showcase versions = 1.22.25...

WordPress Team Showcase Plugin <= 1.22.25 is vulnerable to Cross Site Scripting (XSS)

Software Team Showcase Type Plugin Vulnerable versions = 1.22.25 Fixed in 1.22.26 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44002 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID aa646d7f4421 Credits Le Ngoc Anh Required privilege...

CVE-2024-6493

The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

Shining a Light on Shadow Apps: The Invisible Gateway to SaaS Data Breaches

Shadow apps, a segment of Shadow IT, are SaaS applications purchased without the knowledge of the security team. While these applications may be legitimate, they operate within the blind spots of the corporate security team and expose the company to attackers. Shadow apps may include instances of...

Malicious code in @sky-team/create-project-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c63ed97fa2890cd36683d943cad94b27fa57e5a87b9b16fa38a55970163af5a1 The OpenSSF Package Analysis project identified '@sky-team/create-project-modal' @ 99.50.55 npm as malicious. It is considered malicious because...

MAL-2024-8841 Malicious code in @sky-team/create-project-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c63ed97fa2890cd36683d943cad94b27fa57e5a87b9b16fa38a55970163af5a1 The OpenSSF Package Analysis project identified '@sky-team/create-project-modal' @ 99.50.55 npm as malicious. It is considered malicious because...