PT-2024-35036 · Joan Boluda · Embed Documents Shortcode

Name of the Vulnerable Software and Affected Versions: Joan Boluda Embed documents shortcode versions 1.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. The Embed...

WordPress plugin Embed documents shortcode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

CVE-2024-51904: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Joan Boluda Embed documents shortcode embed-documents-shortcode allows Stored XSS.This issue affects Embed documents shortcode: from n/a through = 1.5...

com.earldouglas:war-runner (>=5.0.0-m5_4.0, <=5.0.0-m6_4.0), com.heroku:webapp-runner (9.0.96.0) +9 more potentially affected by CVE-2024-52318 via org.apache.tomcat.embed:tomcat-embed-jasper (9.0.96)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version 9.0.96 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-jasper and may be impacted: - com.earldouglas:war-runner =5.0.0-m54.0, =8.6.0.37351, =8.9.3.40165,...

com.uwyn.rife2:rife2 (1.9.1), org.redisson:redisson-tomcat-11 (>=3.38.0, <=3.41.0) potentially affected by CVE-2024-52318 via org.apache.tomcat.embed:tomcat-embed-jasper (11.0.0)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-jasper and may be impacted: - com.uwyn.rife2:rife2 1.9.1 - org.redisson:redisson-tomcat-11 =3.38.0,...

com.uwyn.rife2:rife2 (1.9.1), org.redisson:redisson-tomcat-11 (>=3.38.0, <=3.41.0) potentially affected by CVE-2024-52318 via org.apache.tomcat.embed:tomcat-embed-jasper (11.0.0)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-jasper and may be impacted: - com.uwyn.rife2:rife2 1.9.1 - org.redisson:redisson-tomcat-11 =3.38.0,...

cn.bbwres:biscuit-web-boot-starter (0.0.6), com.foreach.across:across-web (5.5.1) +89 more potentially affected by CVE-2024-52317 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.93, <=9.0.95)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.93, =3.2.0, =1.0, =1.0, =1.0, =1.0, =1.0, =1.0, =1.4 and more Source cves: CVE-2024-52317 Source advisory: OSV:GHSA-QVF5-HVJX-WM27...

cn.bbwres:biscuit-web-boot-starter (0.0.6), com.foreach.across:across-web (5.5.1) +89 more potentially affected by CVE-2024-52317 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.93, <=9.0.95)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.93, =3.2.0, =1.0, =1.0, =1.0, =1.0, =1.0, =1.0, =1.4 and more Source cves: CVE-2024-52317 Source advisory: GHSA-QVF5-HVJX-WM27...

ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.1.0), ai.langsa:ccaas-starter (>=cloud-0.1, <=cloud-0.2.1) +1199 more potentially affected by CVE-2024-52317 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.28, <=10.1.30)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.28, =0.0.4, =cloud-0.1, =1.14.0, =1.0.0, =1.0.0, =3.3.3, =3.3.3, =3.3.4 - cn.airfei.air-core:core 5.0.4 - cn.ljserver.tool:web-office-v3 4.0.0 - cn.muzisheng.pear:pear-spring-boot-basic 1.2.0 - cn.muzisheng.pear:pear-spring-boot-cache...

com.xiaohaoo:xiaohao-public (1.0.4), org.apache.tomcat.embed:tomcat-embed-jasper (>=11.0.0-m24, <=11.0.0-m26) +2 more potentially affected by CVE-2024-52317 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m24, <=11.0.0-m26)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m24, =11.0.0-m24, =11.0.0-m24, =2.0.6, =2.0.7 Source cves: CVE-2024-52317 Source advisory: GHSA-QVF5-HVJX-WM27...

com.xiaohaoo:xiaohao-public (1.0.4), org.apache.tomcat.embed:tomcat-embed-jasper (>=11.0.0-m24, <=11.0.0-m26) +2 more potentially affected by CVE-2024-52317 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m24, <=11.0.0-m26)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m24, =11.0.0-m24, =11.0.0-m24, =2.0.6, =2.0.7 Source cves: CVE-2024-52317 Source advisory: OSV:GHSA-QVF5-HVJX-WM27...

ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.1.0), ai.langsa:ccaas-starter (>=cloud-0.1, <=cloud-0.2.1) +1199 more potentially affected by CVE-2024-52317 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.28, <=10.1.30)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.28, =0.0.4, =cloud-0.1, =1.14.0, =1.0.0, =1.0.0, =3.3.3, =3.3.3, =3.3.4 - cn.airfei.air-core:core 5.0.4 - cn.ljserver.tool:web-office-v3 4.0.0 - cn.muzisheng.pear:pear-spring-boot-basic 1.2.0 - cn.muzisheng.pear:pear-spring-boot-cache...

com.earldouglas:war-runner (>=5.0.0-m5_4.0, <=5.0.0-m6_4.0), com.heroku:webapp-runner (9.0.96.0) +9 more potentially affected by CVE-2024-52318 via org.apache.tomcat.embed:tomcat-embed-jasper (9.0.96)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version 9.0.96 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-jasper and may be impacted: - com.earldouglas:war-runner =5.0.0-m54.0, =8.6.0.37351, =8.9.3.40165,...

cn.bbwres:biscuit-web-boot-starter (0.0.6), com.foreach.across:across-web (5.5.1) +89 more potentially affected by CVE-2024-52317 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.93, <=9.0.95)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.93, =3.2.0, =1.0, =1.0, =1.0, =1.0, =1.0, =1.0, =1.4 and more Source cves: CVE-2024-52317 Source advisory: MEND:CVE-2024-52317...

com.xiaohaoo:xiaohao-public (1.0.4), org.apache.tomcat.embed:tomcat-embed-jasper (>=11.0.0-m24, <=11.0.0-m26) +2 more potentially affected by CVE-2024-52317 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m24, <=11.0.0-m26)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m24, =11.0.0-m24, =11.0.0-m24, =2.0.6, =2.0.7 Source cves: CVE-2024-52317 Source advisory: MEND:CVE-2024-52317...

ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.1.0), ai.langsa:ccaas-starter (>=cloud-0.1, <=cloud-0.2.1) +1199 more potentially affected by CVE-2024-52317 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.28, <=10.1.30)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.28, =0.0.4, =cloud-0.1, =1.14.0, =1.0.0, =1.0.0, =3.3.3, =3.3.3, =3.3.4 - cn.airfei.air-core:core 5.0.4 - cn.ljserver.tool:web-office-v3 4.0.0 - cn.muzisheng.pear:pear-spring-boot-basic 1.2.0 - cn.muzisheng.pear:pear-spring-boot-cache...

firefox: thunderbird: Permission leak via embed or object elements

The Mozilla Foundation's Security Advisory: A permission leak could occur from a trusted site to an untrusted site via embed or object elements...

firefox: thunderbird: Permission leak via embed or object elements

The Mozilla Foundation's Security Advisory: A permission leak could occur from a trusted site to an untrusted site via embed or object elements...

CVE-2024-51606

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Blrt Blrt WP Embed blrt-wp-embed allows SQL Injection.This issue affects Blrt WP Embed: from n/a through = 1.6.9...

CVE-2024-51606

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Blrt Blrt WP Embed allows SQL Injection.This issue affects Blrt WP Embed: from n/a through 1.6.9...