CVE Vulnerability Catalog

Stored XSS vulnerability in appRain CMF version 4.0.5 due to lack of input validation in the 'data[Page][name]' parameter in /apprain/page/manage-static-pages/create. Requires authentication.

appRain CMF version 4.0.5 has a stored authenticated XSS vulnerability due to lack of proper validation of user input in the 'data[Admin][description]', 'data[Admin][f_name]', and 'data[Admin][l_name]' parameters in /apprain/admin/account/edit.

In the Vaadin Upload component, when the start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Affected versions include Vaadin 7.0.0-7.7.47, 8.0.0-8.28.1, 14.0.0-14.13.0, 23.0.0-23.6.1, and 24.0.0-24.7.6.

Podatność CVE-2024-13073 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w Akinsoft TaskPano, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten dotyczy wersji s1.06.04 oprogramowania TaskPano.

Podatność CVE-2024-13071 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w Akinsoft e-Mutabakat, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten dotyczy wersji e-Mutabakat od 2.02.05 do przed v2.02.06.

A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the interface does not properly validate user-supplied input. An attacker could exploit this by persuading a user to click a crafted link, allowing arbitrary script execution or access to sensitive browser-based information.

A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure due to improper validation of user-supplied input. An authenticated remote attacker can insert malicious code into specific data fields.

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This is due to improper validation of requests to API endpoints, allowing a low-privileged user to view sensitive configuration information.

Timing differences in login responses allow an attacker to determine whether a user exists. The fix introduces a TimingSafeFormLoginAuthenticator that performs a dummy password hash verification even for non-existent users, ensuring consistent timing.

A reflected Cross-Site Scripting (XSS) vulnerability in the “Tags” input field on the /s/ajax?action=lead:addLeadTags endpoint. User-supplied input is reflected back in the server’s response without proper sanitization or escaping, allowing execution of arbitrary JavaScript in the victim’s session.

The WordPress plugin Contact Form By Mega Forms (versions up to 1.6.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The WordPress plugin PDF for WPForms up to version 6.2.1 contains a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script that gets stored and executed in the victim's browser.

The WordPress plugin Tooltipy up to version 5.5.6 contains a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script that gets stored and executed in the victim's browser.

The Tickera plugin (tickera-event-ticketing-system) in versions up to and including 3.5.5.6 contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows performing unwanted actions on behalf of a logged-in user.

The WP Delicious plugin through version 1.8.7 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script is stored and executed in users' browsers.

The Surfer (surferseo) plugin in versions up to 1.6.4.574 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

A vulnerability in the wpForo Forum plugin allows authorization bypass through a user-controlled key. An attacker can exploit incorrectly configured access control security levels. The issue affects versions up to and including 2.4.6.

The Brizy plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.7.12.

The Orbit Fox by ThemeIsle plugin through version 3.0.0 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script is stored and executed in users' browsers.

A user with administrator rights can change the configuration of the Mautic application and extract secrets that are not normally available. An administrator who usually does not have access to certain parameters, such as database credentials, can disclose them.