BIG-IP LTM, Advanced WAF, ASM, And APM Security Vulnerabilities

CVE-2024-4698

The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'show_line_text ' and 'slide_button_hover_animation' parameters in versions up to, and including, 10.1.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-4709

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘subject’ parameter in versions up to, and including, 5.1.16 due to insufficient input sanitization and output escaping. This makes it....

CVE-2024-2782

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST API endpoint in all versions up to, and including,.....

CVE-2024-2772

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in all versions up to, and including, 5.1.13 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-2771

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all versions up to, and including, 5.1.16. This makes...

CVE-2024-4709 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘subject’ parameter in versions up to, and including, 5.1.16 due to insufficient input sanitization and output escaping. This makes it....

CVE-2024-4698 Testimonial Carousel For Elementor <= 10.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'show_line_text ' and 'slide_button_hover_animation' parameters in versions up to, and including, 10.1.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-2772 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in all versions up to, and including, 5.1.13 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-2782 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST API endpoint in all versions up to, and including,.....

CVE-2024-2771 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all versions up to, and including, 5.1.16. This makes...

CVE-2024-4849

The WordPress Automatic Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 3.94.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-3812

The Salient Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.7 via the 'nectar_icon' shortcode 'icon_linea' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute...

CVE-2024-3811

The Salient Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'icon' shortcode in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-3810

The Salient Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.3 via the 'icon' shortcode 'image' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute...

CVE-2024-3812 Salient Core <= 2.0.7 - Authenticated (Contributor+) Local File Inclusion via Shortcode

The Salient Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.7 via the 'nectar_icon' shortcode 'icon_linea' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute...

CVE-2024-3811 Salient Shortcodes <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Salient Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'icon' shortcode in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-3810 Salient Shortcodes <= 1.5.3 - Authenticated (Contributor+) Local File Inclusion via Shortcode

The Salient Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.3 via the 'icon' shortcode 'image' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute...

CVE-2024-4849 WordPress Automatic <= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter

The WordPress Automatic Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 3.94.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

berentqatar.com Cross Site Scripting vulnerability OBB-3928518

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

CVE-2024-3714

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode when used with a legacy form in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on...

CVE-2024-4374

The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-4891

The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tagName’ parameter in versions up to, and including, 4.5.12 due to insufficient input sanitization and output escaping. This makes it possible for...

twbiobank.org.tw Cross Site Scripting vulnerability OBB-3928517

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

gobiernonuevaesparta.com Cross Site Scripting vulnerability OBB-3928515

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

goldkeyghana.com Cross Site Scripting vulnerability OBB-3928516

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

girlsgpm.davchennai.org Cross Site Scripting vulnerability OBB-3928513

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

CVE-2024-4891 Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tagName’ parameter in versions up to, and including, 4.5.12 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-3714 GiveWP – Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode when used with a legacy form in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on...

CVE-2024-4374 DethemeKit For Elementor <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

carletonltd.com Cross Site Scripting vulnerability OBB-3928505

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

CVE-2024-4865

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: buildkitd, cert-manager, oauth2-proxy, gitlab-pages, prometheus-adapter, thanos, dynamic-localpv-provisioner, terraform-provider-azurerm, coredns, gobuster, terraform-provider-aws, weaviate, cluster-autoscaler, stakater-reloader, scorecard, dex, sigstore-scaffolding,.....

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: buildkitd, cert-manager, tflint, karpenter, oauth2-proxy, kine, nuclei, kube-fluentd-operator, smarter-device-manager, crossplane-provider-azure, gitlab-pages, cloud-sql-proxy, syft, prometheus-adapter, docker-compose, buf, caddy, tekton-chains, thanos,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: buildkitd, pombump, flannel-cni-plugin, tflint, kine, nuclei, nri-haproxy, smarter-device-manager, crossplane-provider-azure, cloud-sql-proxy, prometheus-adapter, yq, caddy, thanos, actions-runner-controller, cert-exporter, dynamic-localpv-provisioner,...

CVE-2024-3177 vulnerabilities

Vulnerabilities for packages: calico, kubernetes, ip-masq-agent, aws-ebs-csi-driver, nodetaint, kubeflow-pipelines, local-static-provisioner, kubernetes-dns-node-cache, node-feature-discovery, kubernetes-csi-driver-hostpath, cluster-autoscaler,...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: buildkitd, cert-manager, pombump, karpenter, oauth2-proxy, smarter-device-manager, crossplane-provider-azure, gitlab-pages, tekton-chains, prometheus-adapter, docker-compose, caddy, kubernetes-ingress-defaultbackend, ipfs, thanos, overmind, external-secrets-operator,.....

CVE-2024-24787 vulnerabilities

Vulnerabilities for packages: buildkitd, cert-manager, pombump, karpenter, oauth2-proxy, smarter-device-manager, crossplane-provider-azure, gitlab-pages, tekton-chains, prometheus-adapter, docker-compose, caddy, kubernetes-ingress-defaultbackend, ipfs, thanos, overmind, external-secrets-operator,.....

CVE-2023-45285 vulnerabilities

Vulnerabilities for packages: flannel-cni-plugin, oras, ip-masq-agent, amass, go-bindata, smarter-device-manager, protoc-gen-go-grpc, gke-gcloud-auth-plugin, goreleaser, influx, cortex, aactl, slsa-verifier, dgraph, cilium-envoy, sbom-scorecard, gosu, wait-for-port, sops, go-md2man, gobuster,...

GHSA-RR6R-CFGF-GC6H vulnerabilities

Vulnerabilities for packages: buildkitd, pombump, flannel-cni-plugin, tflint, kine, nuclei, nri-haproxy, smarter-device-manager, crossplane-provider-azure, cloud-sql-proxy, prometheus-adapter, yq, caddy, thanos, actions-runner-controller, cert-exporter, dynamic-localpv-provisioner,...

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: buildkitd, pombump, flannel-cni-plugin, tflint, kine, nuclei, nri-haproxy, smarter-device-manager, crossplane-provider-azure, cloud-sql-proxy, prometheus-adapter, yq, caddy, thanos, actions-runner-controller, cert-exporter, dynamic-localpv-provisioner,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: buildkitd, cert-manager, tflint, karpenter, oauth2-proxy, kine, nuclei, kube-fluentd-operator, smarter-device-manager, crossplane-provider-azure, gitlab-pages, cloud-sql-proxy, syft, prometheus-adapter, docker-compose, buf, caddy, tekton-chains, thanos,...

CVE-2023-45288 vulnerabilities

Vulnerabilities for packages: flannel-cni-plugin, karpenter, oauth2-proxy, tekton-chains, kubernetes-ingress-defaultbackend, ipfs, dynamic-localpv-provisioner, hcloud, terraform-provider-google, dataplaneapi, dagdotdev, falcoctl, nri-mysql, dex, aws-flb-kinesis, logstash-exporter,...

GHSA-4V7X-PQXF-CX7M vulnerabilities

Vulnerabilities for packages: flannel-cni-plugin, karpenter, oauth2-proxy, tekton-chains, kubernetes-ingress-defaultbackend, ipfs, dynamic-localpv-provisioner, hcloud, terraform-provider-google, dataplaneapi, dagdotdev, falcoctl, nri-mysql, dex, aws-flb-kinesis, logstash-exporter,...

GHSA-2JWV-JMQ4-4J3R vulnerabilities

Vulnerabilities for packages: buildkitd, cert-manager, pombump, karpenter, oauth2-proxy, smarter-device-manager, crossplane-provider-azure, gitlab-pages, tekton-chains, prometheus-adapter, docker-compose, caddy, kubernetes-ingress-defaultbackend, ipfs, thanos, overmind, external-secrets-operator,.....

GHSA-3Q2C-PVP5-3CQP vulnerabilities

Vulnerabilities for packages: buildkitd, pombump, flannel-cni-plugin, tflint, kine, nuclei, nri-haproxy, smarter-device-manager, crossplane-provider-azure, cloud-sql-proxy, prometheus-adapter, yq, caddy, thanos, actions-runner-controller, cert-exporter, dynamic-localpv-provisioner,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: buildkitd, pombump, flannel-cni-plugin, tflint, kine, nuclei, nri-haproxy, smarter-device-manager, crossplane-provider-azure, cloud-sql-proxy, prometheus-adapter, yq, caddy, thanos, actions-runner-controller, cert-exporter, dynamic-localpv-provisioner,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: buildkitd, pombump, flannel-cni-plugin, tflint, kine, nuclei, nri-haproxy, smarter-device-manager, crossplane-provider-azure, cloud-sql-proxy, prometheus-adapter, yq, caddy, thanos, actions-runner-controller, cert-exporter, dynamic-localpv-provisioner,...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: calico, ip-masq-agent, aws-ebs-csi-driver, nodetaint, kubernetes-dns-node-cache, prometheus-adapter, aws-efs-csi-driver, cluster-autoscaler,...

CVE-2023-5528 vulnerabilities

Vulnerabilities for packages: calico, ip-masq-agent, aws-ebs-csi-driver, nodetaint, kubernetes-dns-node-cache, prometheus-adapter, aws-efs-csi-driver, cluster-autoscaler,...

GHSA-9F76-WG39-X86H vulnerabilities

Vulnerabilities for packages: flannel-cni-plugin, oras, ip-masq-agent, amass, go-bindata, smarter-device-manager, protoc-gen-go-grpc, gke-gcloud-auth-plugin, goreleaser, influx, cortex, aactl, slsa-verifier, dgraph, cilium-envoy, sbom-scorecard, gosu, wait-for-port, sops, go-md2man, gobuster,...