Security Bulletin: z/Transaction Processing Facility is affected by an OpenSSL vulnerability

Summary The z/TPF version of OpenSSL was updated to address the vulnerability described by CVE-2024-6119. Vulnerability Details CVEID:CVE-2024-6119 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an error when performing certificate name checks e.g., TLS clients checking serv...

CVE-2024-44542

SQL Injection vulnerability in todesk v.1.1 allows a remote attacker to execute arbitrary code via the /todesk.com/news.html parameter...

CVE-2024-44060

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Jennifer Hall Filmix allows Reflected XSS.This issue affects Filmix: from n/a through 1.1...

WordPress plugin Filmix 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Dell Path to PowerProtect 安全漏洞

Dell Path to PowerProtect is an application from Dell USA Inc. A security vulnerability exists in Dell Path to PowerProtect version 1.1 and 1.2. An unauthorized attacker could exploit the vulnerability to obtain personal information...

WordPress IP Vault – WP Firewall plugin <= 1.1 - IP Address Spoofing to Protection Mechanism Bypass vulnerability

IP Address Spoofing to Protection Mechanism Bypass vulnerability discovered by rezaduty in WordPress Plugin IP Vault – WP Firewall versions = 1.1...

PT-2024-11706 · WordPress · The Ip Vault – Wp Firewall

Name of the Vulnerable Software and Affected Versions: The IP Vault – WP Firewall plugin for WordPress versions up to, and including, 1.1 Description: The issue is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions...

WordPress Filmix Theme <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Filmix Type Theme Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44060 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 23b9f7aa796e Credits justakazh Required privilege Unauthenticated...

PT-2024-38831 · Sourcecodester · Sourcecodester Daily Calories Monitoring Tool

Name of the Vulnerable Software and Affected Versions: SourceCodester Daily Calories Monitoring Tool version 1.0 Description: A vulnerability was found in the SourceCodester Daily Calories Monitoring Tool. This issue affects the file /endpoint/delete-calorie.php and is related to the manipulation...

PT-2024-37286 · WordPress · Cz Loan Management

Name of the Vulnerable Software and Affected Versions: CZ Loan Management WordPress plugin versions 1.1 and earlier Description: The issue arises from the improper sanitization and escaping of a parameter before its use in a SQL statement via an AJAX action. This AJAX action is available to...

WordPress plugin CZ Loan Management 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

14Finger Security Vulnerability

14Finger is a full-featured Web fingerprint recognition and sharing platform by b1ackc4t individual developers. A security vulnerability exists in 14Finger version 1.1, which stems from an arbitrary user deletion vulnerability in component /api/admin/user?id...

PT-2024-27739 · 14Finger · 14Finger

Name of the Vulnerable Software and Affected Versions: 14Finger version 1.1 Description: The issue allows for arbitrary user deletion through the "/api/admin/user?id" API endpoint. This endpoint is used for administrative purposes, and the vulnerability could be exploited to delete users without...

PT-2024-27738 · 14Finger · 14Finger

Name of the Vulnerable Software and Affected Versions: 14Finger version 1.1 Description: Insecure permissions in the component "/api/admin/user" of 14Finger allow attackers to access all user information via a crafted GET request. The username and other sensitive information can be accessed throu...

PT-2024-27740 · 14Finger · 14Finger

Name of the Vulnerable Software and Affected Versions: 14Finger version 1.1 Description: Insecure permissions in the software allow attackers to escalate privileges from a normal user to Administrator via a crafted POST request. This issue can be exploited by sending a manipulated POST request to...

Security Bulletin: IBM Asset Data Dictionary Component uses zookeeper-3.5.9.jar and snappy-java-1.1.8.3.jar which are vulnerable to CVE-2023-44981,CVE-2023-34453, CVE-2023-34455 , CVE-2023-34454 and CVE-2023-43642

Summary IBM Asset Data Dictionary Component uses zookeeper-3.5.9.jar and snappy-java-1.1.8.3.jar which are vulnerable to CVE-2023-44981,CVE-2023-34453, CVE-2023-34455, CVE-2023-34454 and CVE-2023-43642. This bulletin contains information regarding the vulnerability and its remediation...

WordPress SVGMagic Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software SVGMagic Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4270 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 09ac0fcf4d2c Credits Rayhan Ramdhany Hanaputra Required...

CVE-2024-4289

The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-4289 Sailthru Triggermail <= 1.1 - Reflected XSS

The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress Plugin Sailthru Triggermail 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...