CVE-2024-29180

Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the...

CVE-2024-29180

CVE-2024-29180 affects the webpack-dev-middleware development middleware used with webpack-dev-server/webpack-dev-middleware. The vulnerability arises from improper URL unescaping/normalization before parsing the requested file, allowing path traversal via sequences like %2e and %2f to access loc...

CVE-2024-29870

CVE-2024-29870 affects Sentrifugo 3.2. The vulnerability is a SQL injection in the endpoint /sentrifugo/index.php/index/getdepartments/format/html, exploiting the business_id parameter. This could allow a remote attacker to craft a query to extract data from the database. The root cause is lack o...

frameready.ca Cross Site Scripting vulnerability OBB-3882497

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

shop-016.de Cross Site Scripting vulnerability OBB-3881795

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

digikogu.ekm.ee Cross Site Scripting vulnerability OBB-3881614

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Docassemble 安全漏洞

Docassemble is a free, open source expert system for guided interviews and document assembly. An open redirection vulnerability exists in versions prior to Docassemble 1.4.97, which stems from the system's failure to reasonably handle target jumps, and can be exploited by an attacker to redirect ...

meridiangroupinc.net Cross Site Scripting vulnerability OBB-3881397

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

screenmediafilms.net Cross Site Scripting vulnerability OBB-3881285

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

DEBIAN-CVE-2024-2627

Use after free in Canvas in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

$601 Bounty Awarded for Interesting Cross-Site Request Forgery to Local JS File Inclusion Vulnerability Patched in File Manager WordPress Plugin

🎉 Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure! On February 15th, 2024, during our second Bug Bounty Extravaganza...

listingstoronto.info Cross Site Scripting vulnerability OBB-3881012

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

historisches-festmahl.de.xx3.kz Cross Site Scripting vulnerability OBB-3880934

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PortSwigger Web Security: [portswigger.net] Path Traversal al /cms/audioitems

Vulnerability description not provided...

CVE-2024-29469

OneBlog v2.3.4 is affected by a stored cross-site scripting (XSS) vulnerability within the Lab module . The root cause is a lack of effective filtering and escaping of user-supplied data in the Category List parameter. An attacker can exploit this by injecting a crafted payload to execute arbitra...

TOTOLINK X2000R 安全漏洞

TOTOLINK X2000R is a WiFi 6 router from China's Gion Electronics that supports Gigabit network and Easy Mesh features with multi-device connectivity and wireless expansion capabilities. The TOTOLINK X2000R suffers from a cross-site scripting vulnerability that stems from the application's lack of...

CVE-2024-29114

CVE-2024-29114 is a Stored XSS in the WordPress Download Manager plugin (Download Manager Pro). Affected: Download Manager from n/a up to version 3.2.84. The vulnerability is addressed in patched builds; remediation is to upgrade to a fixed release.

CVE-2024-29123

CVE-2024-29123: Reflected XSS in Yannick Lefebvre Link Library (WordPress plugin) due to improper input neutralization during page generation. Affected: Link Library plugin for WordPress, versions up to 7.6. Outcome per sources: the vulnerability exists and has a patch available; risk details and...

CVE-2024-29127

CVE-2024-29127 affects Advanced Access Manager (WordPress) up to version 6.9.20 with a Reflected XSS due to improper input neutralization in web page generation. A fixed release is 6.9.21; update to mitigate. References indicate CVSS ~7.1 (Patchstack) / ~6.1 (NVD) depending on source.

CVE-2024-29137

The Tourfic plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 2.11.7 . The root cause is insufficient input sanitization and output escaping within the 'place' parameter. An attacker can exploit this to execute malicious scripts in users' b...