YARPP – Yet Another Related Posts Plugin Security Vulnerabilities

CVE-2024-4980

The WPKoi Templates for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id', 'mixColor', 'backgroundColor', 'saveInCookies', and 'autoMatchOsTheme' parameters in all versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping....

CVE-2024-4980 WPKoi Templates for Elementor <= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters

The WPKoi Templates for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id', 'mixColor', 'backgroundColor', 'saveInCookies', and 'autoMatchOsTheme' parameters in all versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping....

CVE-2024-0452

The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_upload_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2024-0451

The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

CVE-2024-0453

The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_delete_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2024-0452 AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_upload_callback

The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_upload_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2024-0453 AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_delete_callback

The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_delete_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2024-0451 AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_list_callback

The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

CVE-2023-44487 affecting package sriov-network-device-plugin for versions less than 3.5.1-2

CVE-2023-44487 affecting package sriov-network-device-plugin for versions less than 3.5.1-2. A patched version of the package is...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: kubewatch, prometheus-stackdriver-exporter, argo-cd, weaviate, dex, gitlab-runner, haproxy-ingress, gatekeeper, cue, flux-source-controller, flux-notification-controller, terraform-provider-azurerm, node-problem-detector, calico, memcached-exporter, src, kubescape,...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: kubewatch, tigera-operator, nerdctl, terraform-provider-google, rook, kube-logging-operator, prometheus-stackdriver-exporter, argo-cd, kube-state-metrics, thanos-operator, prometheus-mongodb-exporter, velero, istio-pilot-discovery, nuclei, weaviate, dex,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: kubewatch, tigera-operator, nerdctl, nri-nagios, wait-for-port, aws-flb-firehose, kube-logging-operator, argo-cd, kube-state-metrics, http-echo, esbuild, prometheus-mongodb-exporter, thanos-operator, velero, nuclei, gitlab-logger, dex, gitlab-runner, go-licenses,...

GHSA-VVPX-J8F3-3W6H vulnerabilities

Vulnerabilities for packages: falco, hey, wireguard-go, restic, go, k3d, gke-gcloud-auth-plugin, dynamic-localpv-provisioner,...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: nerdctl, skaffold, syft, wolfictl, k3d, nvidia-device-plugin, k9s, newrelic-infrastructure-agent, ingress-nginx-controller, kaniko, runc, datadog-agent, cadvisor, kots, kubernetes, docker, ctop, buildkitd, zot, trivy, kubescape, k3s, telegraf, grype, zarf,...

CVE-2023-45288 vulnerabilities

Vulnerabilities for packages: terraform-provider-google, kube-logging-operator, cert-manager-webhook-pdns, prometheus-stackdriver-exporter, http-echo, prometheus-mongodb-exporter, nuclei, gitlab-logger, dex, kubernetes-ingress-defaultbackend, actions-runner-controller, flux-source-controller,...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: kubewatch, tigera-operator, wait-for-port, cert-manager-webhook-pdns, kube-state-metrics, http-echo, overmind, dex, gitlab-runner, go-licenses, vault-k8s, regclient, kubernetes-ingress-defaultbackend, cue, flux-source-controller, render-template, dockerize,...

CVE-2024-24787 vulnerabilities

Vulnerabilities for packages: kubewatch, tigera-operator, wait-for-port, cert-manager-webhook-pdns, kube-state-metrics, http-echo, overmind, dex, gitlab-runner, go-licenses, vault-k8s, regclient, kubernetes-ingress-defaultbackend, cue, flux-source-controller, render-template, dockerize,...

CVE-2023-45285 vulnerabilities

Vulnerabilities for packages: nri-discovery-kubernetes, sops, wait-for-port, aws-flb-firehose, influx, prometheus-stackdriver-exporter, configmap-reload, gitlab-logger, k3d, go-licenses, petname, nsc, docker-credential-ecr-login, metrics-server, cni-plugins, oras, render-template, hey, cortex,...

CVE-2023-3978 vulnerabilities

Vulnerabilities for packages: kubewatch, kube-logging-operator, prometheus-stackdriver-exporter, argo-cd, kube-state-metrics, thanos-operator, prometheus-mongodb-exporter, weaviate, dex, gitlab-runner, haproxy-ingress, gatekeeper, vault-k8s, cue, flux-source-controller,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: kubewatch, tigera-operator, nerdctl, terraform-provider-google, rook, kube-logging-operator, prometheus-stackdriver-exporter, argo-cd, kube-state-metrics, thanos-operator, prometheus-mongodb-exporter, velero, istio-pilot-discovery, nuclei, weaviate, dex,...

GHSA-RR6R-CFGF-GC6H vulnerabilities

Vulnerabilities for packages: kubewatch, tigera-operator, nerdctl, nri-nagios, wait-for-port, aws-flb-firehose, kube-logging-operator, argo-cd, kube-state-metrics, http-echo, esbuild, prometheus-mongodb-exporter, thanos-operator, velero, nuclei, gitlab-logger, dex, gitlab-runner, go-licenses,...

CVE-2022-41723 vulnerabilities

Vulnerabilities for packages: falco, hey, wireguard-go, restic, go, k3d, gke-gcloud-auth-plugin, dynamic-localpv-provisioner,...

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: kubewatch, tigera-operator, nerdctl, nri-nagios, wait-for-port, aws-flb-firehose, kube-logging-operator, argo-cd, kube-state-metrics, http-echo, esbuild, prometheus-mongodb-exporter, thanos-operator, velero, nuclei, gitlab-logger, dex, gitlab-runner, go-licenses,...

GHSA-4V7X-PQXF-CX7M vulnerabilities

Vulnerabilities for packages: terraform-provider-google, kube-logging-operator, cert-manager-webhook-pdns, prometheus-stackdriver-exporter, http-echo, prometheus-mongodb-exporter, nuclei, gitlab-logger, dex, kubernetes-ingress-defaultbackend, actions-runner-controller, flux-source-controller,...

GHSA-2JWV-JMQ4-4J3R vulnerabilities

Vulnerabilities for packages: kubewatch, tigera-operator, wait-for-port, cert-manager-webhook-pdns, kube-state-metrics, http-echo, overmind, dex, gitlab-runner, go-licenses, vault-k8s, regclient, kubernetes-ingress-defaultbackend, cue, flux-source-controller, render-template, dockerize,...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: kubewatch, kube-logging-operator, prometheus-stackdriver-exporter, argo-cd, kube-state-metrics, thanos-operator, prometheus-mongodb-exporter, istio-pilot-discovery, weaviate, dex, gitlab-runner, haproxy-ingress, gatekeeper, vault-k8s,...

GHSA-3Q2C-PVP5-3CQP vulnerabilities

Vulnerabilities for packages: kubewatch, tigera-operator, nerdctl, nri-nagios, wait-for-port, aws-flb-firehose, kube-logging-operator, argo-cd, kube-state-metrics, http-echo, esbuild, prometheus-mongodb-exporter, thanos-operator, velero, nuclei, gitlab-logger, dex, gitlab-runner, go-licenses,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: kubewatch, tigera-operator, nerdctl, nri-nagios, wait-for-port, aws-flb-firehose, kube-logging-operator, argo-cd, kube-state-metrics, http-echo, esbuild, prometheus-mongodb-exporter, thanos-operator, velero, nuclei, gitlab-logger, dex, gitlab-runner, go-licenses,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: kubewatch, tigera-operator, nerdctl, nri-nagios, wait-for-port, aws-flb-firehose, kube-logging-operator, argo-cd, kube-state-metrics, http-echo, esbuild, prometheus-mongodb-exporter, thanos-operator, velero, nuclei, gitlab-logger, dex, gitlab-runner, go-licenses,...

CVE-2023-39326 vulnerabilities

Vulnerabilities for packages: nri-discovery-kubernetes, sops, wait-for-port, aws-flb-firehose, influx, prometheus-stackdriver-exporter, configmap-reload, gitlab-logger, k3d, go-licenses, petname, nsc, docker-credential-ecr-login, metrics-server, cni-plugins, oras, render-template, hey, cortex,...

GHSA-9F76-WG39-X86H vulnerabilities

Vulnerabilities for packages: nri-discovery-kubernetes, sops, wait-for-port, aws-flb-firehose, influx, prometheus-stackdriver-exporter, configmap-reload, gitlab-logger, k3d, go-licenses, petname, nsc, docker-credential-ecr-login, metrics-server, cni-plugins, oras, render-template, hey, cortex,...

GHSA-5F94-VHJQ-RPG8 vulnerabilities

Vulnerabilities for packages: nri-discovery-kubernetes, sops, wait-for-port, aws-flb-firehose, influx, prometheus-stackdriver-exporter, configmap-reload, gitlab-logger, k3d, go-licenses, petname, nsc, docker-credential-ecr-login, metrics-server, cni-plugins, oras, render-template, hey, cortex,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: kubewatch, kube-logging-operator, prometheus-stackdriver-exporter, argo-cd, kube-state-metrics, thanos-operator, prometheus-mongodb-exporter, istio-pilot-discovery, weaviate, dex, gitlab-runner, haproxy-ingress, gatekeeper, vault-k8s,...

GHSA-2WRH-6PVC-2JM9 vulnerabilities

Vulnerabilities for packages: kubewatch, kube-logging-operator, prometheus-stackdriver-exporter, argo-cd, kube-state-metrics, thanos-operator, prometheus-mongodb-exporter, weaviate, dex, gitlab-runner, haproxy-ingress, gatekeeper, vault-k8s, cue, flux-source-controller,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: kubewatch, prometheus-stackdriver-exporter, argo-cd, weaviate, dex, gitlab-runner, haproxy-ingress, gatekeeper, cue, flux-source-controller, flux-notification-controller, terraform-provider-azurerm, node-problem-detector, calico, memcached-exporter, src, kubescape,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: prometheus-stackdriver-exporter, argo-cd, envoy-ratelimit, prometheus-blackbox-exporter, weaviate, cluster-autoscaler, dex, k3d, pulumi-kubernetes-operator, pulumi-language-java, gatekeeper, secrets-store-csi-driver, nvidia-device-plugin, metrics-server, external-dns,....

GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: kubewatch, tigera-operator, nerdctl, nri-nagios, wait-for-port, aws-flb-firehose, kube-logging-operator, argo-cd, kube-state-metrics, http-echo, esbuild, prometheus-mongodb-exporter, thanos-operator, velero, nuclei, gitlab-logger, dex, gitlab-runner, go-licenses,...

CVE-2024-24783 vulnerabilities

Vulnerabilities for packages: kubewatch, tigera-operator, nerdctl, nri-nagios, wait-for-port, aws-flb-firehose, kube-logging-operator, argo-cd, kube-state-metrics, http-echo, esbuild, prometheus-mongodb-exporter, thanos-operator, velero, nuclei, gitlab-logger, dex, gitlab-runner, go-licenses,...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: kubewatch, tigera-operator, nerdctl, nri-nagios, wait-for-port, aws-flb-firehose, kube-logging-operator, argo-cd, kube-state-metrics, http-echo, esbuild, prometheus-mongodb-exporter, thanos-operator, velero, nuclei, gitlab-logger, dex, gitlab-runner, go-licenses,...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: kubewatch, tigera-operator, wait-for-port, cert-manager-webhook-pdns, kube-state-metrics, http-echo, overmind, dex, gitlab-runner, go-licenses, vault-k8s, regclient, kubernetes-ingress-defaultbackend, cue, flux-source-controller, render-template, dockerize,...

CVE-2023-45290 vulnerabilities

Vulnerabilities for packages: kubewatch, tigera-operator, nerdctl, nri-nagios, wait-for-port, aws-flb-firehose, kube-logging-operator, argo-cd, kube-state-metrics, http-echo, esbuild, prometheus-mongodb-exporter, thanos-operator, velero, nuclei, gitlab-logger, dex, gitlab-runner, go-licenses,...

GHSA-XR7R-F8XQ-VFVV vulnerabilities

Vulnerabilities for packages: nerdctl, skaffold, syft, wolfictl, k3d, nvidia-device-plugin, k9s, newrelic-infrastructure-agent, ingress-nginx-controller, kaniko, runc, datadog-agent, cadvisor, kots, kubernetes, docker, ctop, buildkitd, zot, trivy, kubescape, k3s, telegraf, grype, zarf,...

Updated stb packages fix security vulnerabilities

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in start_decoder. The root cause is a potential integer overflow in sizeof(char*) * (f-&gt;comment_list_length) which may make setup_malloc allocat...

CVE-2024-3519

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up to, and including, 3.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-3518

The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible.....

CVE-2024-3518 Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode

The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible.....

CVE-2024-3519 Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up to, and including, 3.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-35220

@fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the expires field is overriden if the maxAge field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not...

CVE-2024-35220 @fastify/session reuses destroyed session cookie

@fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the expires field is overriden if the maxAge field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not...

How to remove a user from a shared Android device

Some of our loyal readers may remember my little mishap when I was able to track my wife by accident after inadvertently adding myself to her phone as a user. For exactly that reason we want to warn against sharing devices and at least show you how to remove other people’s accounts from your...