Aggregator

A vulnerability was found in wolfgang101 Include Mastodon Feed Plugin up to 1.9.5 on WordPress. It has been classified as problematic. Affected is the function include-mastodon-feed of the component Shortcode Handler. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2024-11455. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in faktorvier F4 Improvements Plugin up to 1.9.0 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component SVG File Upload Handler. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2024-9442. The attack can be launched remotely. There is no exploit available.

A vulnerability was found in peepso Community Plugin up to 6.4.6.2 on WordPress and classified as problematic. This issue affects some unknown processing. The manipulation of the argument filter leads to cross site scripting. The identification of this vulnerability is CVE-2024-11447. The attack may be initiated remotely. There is no exploit available.

A vulnerability has been found in aishan Lazy load videos and sticky control Plugin up to 3.0.0 on WordPress and classified as problematic. This vulnerability affects the function lazy-load-videos-and-sticky-control of the component Shortcode Handler. The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-11428. The attack can be initiated remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in goback2 salavat counter Plugin up to 0.9.1 on WordPress. Affected by this issue is some unknown functionality. The manipulation of the argument page leads to cross site scripting. This vulnerability is handled as CVE-2024-11435. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in feedmymedia LSX Tour Operator Plugin up to 1.4.9 on WordPress. This affects an unknown part of the component SVG File Upload Handler. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-9851. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability classified as problematic was found in greyowl0015 Grey Owl Lightbox Plugin up to 1.6.1 on WordPress. Affected by this vulnerability is the function gol_button of the component Shortcode Handler. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2024-11440. The attack can be launched remotely. There is no exploit available.

A vulnerability classified as problematic has been found in pengbos Slick Sitemap Plugin up to 2.0.0 on WordPress. Affected is the function slick-sitemap of the component Shortcode Handler. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2024-11424. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in alexvtn WIP Incoming Lite Plugin up to 1.1.1 on WordPress. It has been rated as problematic. This issue affects the function save_option of the component Setting Handler. The manipulation leads to cross-site request forgery. The identification of this vulnerability is CVE-2024-11416. The attack may be initiated remotely. There is no exploit available.

A vulnerability was found in alexvtn SuevaFree Essential Kit Plugin up to 1.1.3 on WordPress. It has been declared as problematic. This vulnerability affects the function counter of the component Shortcode Handler. The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-11432. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in Opencast up to 13.9/14.2. It has been classified as critical. This affects an unknown part of the component Video Capture Handler. The manipulation leads to allocation of resources. This vulnerability is uniquely identified as CVE-2024-52797. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Threat hunters are warning about an updated version of the Python-based NodeStealer that's now equipped to extract more information from victims' Facebook Ads Manager accounts and harvest credit card data stored in web browsers. "They collect budget details of Facebook Ads Manager accounts of their victims, which might be a gateway for Facebook malvertisement," Netskope Threat Labs researcher

A vulnerability was found in Okta Privileged Access Server Agent up to 1.84.0 and classified as critical. Affected by this issue is some unknown functionality of the component SFTD. The manipulation leads to improper input validation. This vulnerability is handled as CVE-2024-9875. Attacking locally is a requirement. There is no exploit available.

A vulnerability has been found in Querydsl 5.1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component JPAQuery. The manipulation of the argument orderBy leads to sql injection. This vulnerability is known as CVE-2024-49203. The attack can only be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in Brocade SANnav up to 2.2.1. Affected is an unknown function of the component Switch Password Handler. The manipulation leads to sensitive information in log files. This vulnerability is traded as CVE-2022-43936. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in Piwigo 14.5.0. This issue affects some unknown processing of the component Configuration Page. The manipulation of the argument Page banner leads to cross site scripting. The identification of this vulnerability is CVE-2024-52701. The attack may be initiated remotely. There is no exploit available.

A vulnerability classified as critical was found in eSoft Planner 3.24.08271-USA. This vulnerability affects unknown code of the component Web Request Handler. The manipulation leads to improper access controls. This vulnerability was named CVE-2024-48536. Access to the local network is required for this attack to succeed. There is no exploit available.

A vulnerability was found in eSoft Planner 3.24.08271-USA. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Appointment Availability Module. The manipulation leads to denial of service. This vulnerability is handled as CVE-2024-48530. The attack needs to be initiated within the local network. There is no exploit available.

A vulnerability classified as problematic has been found in eSoft Planner 3.24.08271-USA. This affects an unknown part. The manipulation of the argument Name leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-48535. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in eSoft Planner 3.24.08271-USA. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Camp Details Module. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2024-48534. The attack can be launched remotely. There is no exploit available.