WordPress plugin Display custom fields in the frontend – Post and User Profile Fields 安全漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. WordPress plugin Display custom fields in the frontend...

PT-2024-12259 · Unknown · Display Custom Fields In The Frontend – Post/User Profile Fields

Name of the Vulnerable Software and Affected Versions: Display custom fields in the frontend – Post and User Profile Fields versions 1.2.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security...

Malicious code in auto-plugin-appetize-cleanup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b5ae41ae089a0123963d0d11e9e9c097d2ea1c9a9610c8b8d626303631ed5e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in file-dep-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 167e76bf6af632f8aff7b06b0a8b05d6a25772b2cb139605e13b5b9a84ecf53b The OpenSSF Package Analysis project identified 'file-dep-a' @ 1.2.0 npm as malicious. It is considered malicious because: - The package...

PT-2024-17337 · WordPress · 코드엠샵 소셜톡

Name of the Vulnerable Software and Affected Versions: 코드엠샵 소셜톡 plugin for WordPress version 1.2.0 and earlier Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'msntt add plus talk' shortcode due to insufficient input sanitization and output escaping on...

WordPress plugin 코드엠샵 소셜톡 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

WordPress 코드엠샵 소셜톡 plugin <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin 코드엠샵 소셜톡 versions = 1.2.0...

PT-2024-16186 · WordPress · Cookielay

Name of the Vulnerable Software and Affected Versions: Cookielay plugin for WordPress versions up to, and including, 1.2.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's cookielay shortcode due to insufficient input sanitization and output escaping on...

WordPress plugin Cookielay 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

CVE-2024-54140

CVE-2024-54140 : sigstore-java has insufficient verification in KeylessVerifier.verify(), allowing a bundle to provide an invalid signature for a checkpoint and potentially an inclusion proof that doesn’t match the intended log. Impact is described as low for non-monitor/witness clients; fixes ar...

CVE-2024-54140 sigstore-java has a vulnerability with bundle verification

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundle provides a invalid signature for a checkpoint. This bug impacts clients using any variation of KeylessVerifier.verify. Currently...

sigstore-java 输入验证错误漏洞

sigstore-java is a sigstore open source sigstore java client for interacting with the sigstore infrastructure. An input validation error vulnerability exists in versions of sigstore-java prior to 1.2.0, which stems from an inability to adequately validate a user if they provide an invalid signatu...

PT-2024-36069 · Unknown · Sigstore-Java

Name of the Vulnerable Software and Affected Versions: sigstore-java versions prior to 1.2.0 Description: The issue is related to insufficient verification for a situation where a bundle provides an invalid signature for a checkpoint. This affects clients using any variation of...

CVE-2024-53786

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Codeless Cowidgets – Elementor Addons allows Stored XSS.This issue affects Cowidgets – Elementor Addons: from n/a through 1.2.0...

PT-2024-35899 · Elementor · Codeless Cowidgets – Elementor Addons

Name of the Vulnerable Software and Affected Versions: Codeless Cowidgets – Elementor Addons versions prior to 1.2.0 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This enables attackers to inject...

WordPress plugin 活动链接推广插件 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site...

This Week in Spring - November 19th, 2024

Hi, Spring fans! How are you? Can you believe we're already staring at the end of the month? It's that time of the year when we see new releases, and the new releases reflect that frenzy! Soon: Spring Boot 3.4.0! Are you updated? Make sure you're updated! Remember: Spring projects leave open sour...

WordPress plugin Smart Mockups 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

PT-2024-34941 · 活动链接推广插件 · 活动链接推广插件

Name of the Vulnerable Software and Affected Versions: 活动链接推广插件 versions 1.2.0 and earlier Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This affects user data security...

Important: Red Hat Security Advisory: Red Hat Trusted Profile Analyzer 1.2.0

Red Hat Trusted Profile Analyzer 1.2.0 release Red Hat Product Security has rated this update as having a security impact of Moderate Red Hat Trusted Profile Analyzer 1.2.0...