2208 matches found
CVE-2024-3093
CVE-2024-3093 is a duplicate of CVE-2024-1752 for the Font Farsi WordPress plugin. Connected sources indicate the issue affects Font Farsi
CVE-2024-2845
CVE-2024-2845 covers a Stored Cross-Site Scripting vulnerability in the WordPress plugin “BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg” up to and including version 3.4.2. The Red Hat and Wordfence entries describe the flaw...
CVE-2024-2200
The CVE CVE-2024-2200 concerns WordPress plugin Contact Form by BestWebSoft. Affected versions: all up to and including 4.2.8. Root cause: insufficient input sanitization and output escaping leads to Reflected Cross-Site Scripting via the cntctfrm_contact_subject parameter. Impact: unauthenticate...
CVE-2024-1904
CVE-2024-1904 affects the MasterStudy LMS WordPress plugin (up to and including 3.2.13). The issue is a missing capability check in the search_posts function, allowing authenticated users with subscriber-level access or higher to view draft post titles and excerpts. Impact is unauthorized data ex...
CVE-2024-1637
The CVE-2024-1637 entry concerns the 360 Javascript Viewer WordPress plugin. Affected versions are all versions up to and including 1.7.12, where an unauthorized modification of data is possible due to a missing capability check and nonce exposure on multiple AJAX actions. The vulnerability can b...
CVE-2024-1974
CVE-2024-1974 : The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in render() in versions up to 2.4.6. Authenticated attackers with contributor+ access can read arbitrary server files. The issue is documented by Wordfence and Red Hat; a fix is a...
CVE-2024-2185
CVE-2024-2185 concerns Beaver Builder Addons by WPZOOM for WordPress. Connected sources confirm a Stored XSS via the Image Box widget affecting versions up to 1.3.4 due to insufficient input sanitization/output escaping. Exploitation is reported to require at least Contributor+ authentication; th...
CVE-2024-0083
NVIDIA ChatRTX for Windows is affected by a UI-based cross-site scripting vulnerability (CVE-2024-0083) that can be triggered by network-delivered malicious scripts. The issue affects version 0.2 and earlier; exploitation could lead to code execution, denial of service, and information disclosure...
CVE-2024-1956
CVE-2024-1956 affects the WordPress plugin WPB Show Core prior to version 2.7. The vulnerability is a reflected XSS caused by insufficient sanitization/escaping of parameters in responses to unauthenticated requests. Multiple sources (Red Hat, CVE lists, Patchstack, WPVulndb) confirm the issue an...
CVE-2024-1752
The CVE-2024-1752 entry concerns Font Farsi WordPress plugin versions ≤ 1.6.6. The issue is stored XSS caused by insufficient sanitization/escaping of certain settings, enabling high-privilege users (e.g., admins) to inject scripts even when unfiltered_html is disallowed (including multisite setu...
CVE-2024-1958
CVE-2024-1958 affects the WPB Show Core WordPress plugin prior to version 2.7, where a parameter is not sanitised/escaped before being output on the page, causing a Reflected XSS vulnerability. Patch/upgrade to WPB Show Core 2.7 or later to remediate; the vulnerability is triggered via output re...
CVE-2024-1588
The CVE CVE-2024-1588 affects the WordPress plugin “SendPress Newsletters” up to version 1.23.11.6. The issue is an Admin+ Stored XSS via Settings vulnerability caused by insufficient sanitisation/escaping of certain settings, enabling stored cross-site scripting by high-privilege users (e.g., ad...
CVE-2024-1292
CVE-2024-1292 affects the WPB Show Core WordPress plugin prior to 2.7. The issue is a Reflected Cross-Site Scripting caused by insufficient sanitisation/escaping of parameters before they are output in the page, potentially exploitable against high-privilege users (e.g., admins). Public sources i...
CVE-2024-1589
The CVE-2024-1589 issue affects the WordPress SendPress Newsletters plugin up to version 1.23.11.6. The root cause is that certain settings are not properly sanitised/escaped, enabling Stored Cross-Site Scripting (stored XSS) by high-privilege users (e.g., admins), even when unfiltered_html is di...
CVE-2024-2444
CVE-2024-2444 affects the Inline Related Posts WordPress plugin (before 3.5.0). The issue is stored XSS due to insufficient sanitisation/escaping of certain settings, enabling high-privilege users (e.g., Administrators) to perform Cross-Site Scripting attacks. The vulnerability is exploitable via...
CVE-2023-5973
Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved characters. This could allow an authenticated user to alter the UI of the Brocade Switch and change ports display...
Truncated port name (CVE-2023-5973)
Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved characters. This could allow an authenticated user to alter the UI of the Brocade Switch and change ports display. Note: The vulnerability doesn...
CVE-2023-38729
CVE-2023-38729 affects IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) across multiple releases. The vulnerability enables sensitive information disclosure when using ADMIN_CMD with IMPORT or EXPORT. Affected versions include Db2 10.5, 11.1, and 11.5; exploitation details are t...
CVE-2024-27254
CVE-2024-27254 affects IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data (versions in the 3.0/4.x line as listed in the remediation table) with a denial-of-service condition from a specially crafted query. The connected Red Hat entry confirms the vulnerability details and scop...