iniNet Solutions SpiderControl SCADA PC HMI Editor 路径遍历漏洞

iniNet Solutions SpiderControl SCADA PC HMI Editor is an HMI editor from iniNet Solutions. A path traversal vulnerability exists in iniNet Solutions SpiderControl SCADA PC HMI Editor, which stems from the fact that when it loads a malicious ems project template file, an attacker can write the fil...

PT-2024-8657 · Velocity +2 · Velocity +2

Name of the Vulnerable Software and Affected Versions: Butterfly framework versions prior to 1.2.6 Description: The Butterfly framework has a weakness related to incorrect restriction of the path name to a directory with limited access. This can be exploited by an attacker with network access to...

PT-2024-15998 · Elementor · Elementor Header & Footer Builder

Name of the Vulnerable Software and Affected Versions: Elementor Header & Footer Builder plugin for WordPress versions up to, and including, 1.6.43 Description: The issue allows authenticated attackers with Contributor-level access and above to view the contents of Draft, Private, and...

WordPress Elementor – Header, Footer & Blocks Template Plugin <= 1.6.43 is vulnerable to Sensitive Data Exposure

Software Elementor – Header, Footer & Blocks Template Type Plugin Vulnerable versions = 1.6.43 Fixed in 1.6.44 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-10050 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 22957639a0e5...

CVE-2024-9541

The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the render function in includes/widgets/canvas-menu/canvas-menu.php. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-9541 News Kit Elementor Addons <= 1.2.1 - Authenticated (Contributor+) Sensitive Information Exposure via Canvas Menu Elementor Template

The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the render function in includes/widgets/canvas-menu/canvas-menu.php. This makes it possible for authenticated attackers, with Contributor-level access...

OESA-2024-2278 python-django security update

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize and urlizetrunc template filters are subject to a potential...

CVE-2024-49288

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in VillaTheme Email Template Customizer for WooCommerce allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.2.5...

CVE-2024-49288

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through = 1.2.9.1...

CVE-2024-49288 WordPress Email Template Customizer for WooCommerce plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in VillaTheme Email Template Customizer for WooCommerce allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.2.5...

CVE-2024-49288 WordPress Email Template Customizer for WooCommerce plugin <= 1.2.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through = 1.2.9.1...

CVE-2024-49288

CVE-2024-49288 is a Stored XSS in the WordPress plugin Email Template Customizer for WooCommerce (VillaTheme). Affected versions are

SideWinder APT Strikes Middle East and Africa With Stealthy Multi-Stage Attack

An advanced persistent threat APT actor with suspected ties to India has sprung forth with a flurry of attacks against high-profile entities and strategic infrastructures in the Middle East and Africa. The activity has been attributed to a group tracked as SideWinder, which is also known as...

CVE-2024-3186

CWE-476 NULL Pointer Dereference vulnerability in the evalExpr function of GoAhead Web Server version = 6.0.0 when compiled with the MEGOAHEADJAVASCRIPT flag. This vulnerability allows a remote attacker with the privileges to modify JavaScript template JST files to trigger a crash and cause a...

CVE-2024-3186

GoAhead Web Server (embedded GoAhead) contains a CWE-476 NULL Pointer Dereference in evalExpr() (and related valexpr in GoAhead) on versions 6.0.0 and earlier when built with ME_GOAHEAD_JAVASCRIPT. A remote attacker able to modify JST templates can trigger a crash leading to DoS. Affected product...

CVE-2024-3186

CWE-476 NULL Pointer Dereference vulnerability in the evalExpr function of GoAhead Web Server version = 6.0.0 when compiled with the MEGOAHEADJAVASCRIPT flag. This vulnerability allows a remote attacker with the privileges to modify JavaScript template JST files to trigger a crash and cause a...

PT-2024-24257

Name of the Vulnerable Software and Affected Versions Goahead versions = 6.0.0 Description This issue involves two Use After Free UAF and one Double Free vulnerabilities. These vulnerabilities are caused by JST values not being nulled when freed during parsing of JST templates. If the ME GOAHEAD...

Embedthis Software GoAhead 安全漏洞

Embedthis Software GoAhead is a small open source embedded web server from Embedthis Software. A security vulnerability exists in Embedthis Software GoAhead 6.0.0 and earlier versions, which stems from a null pointer dereference vulnerability in the valexpr function that allows a remote attacker ...

Embedthis Software GoAhead 资源管理错误漏洞

Embedthis Software GoAhead is an open source, small embedded web server from Embedthis Software, USA. A resource management error vulnerability exists in Embedthis Software GoAhead versions 6.0.0 and earlier, which stems from failing to clear JST values when they are freed during the parsing of J...

WordPress plugin Email Template Customizer for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...