CVE-2024-53987 Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails = 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitiz...

CVE-2024-53986 Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails = 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitiz...

CVE-2024-53989 Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails = 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitiz...

WordPress plugin RingCentral Communications 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2024-35317 · No Nonsense · Document & Data Automation

Name of the Vulnerable Software and Affected Versions: No-nonsense Labs Document & Data Automation versions prior to 1.6.1 Description: The issue is related to a Cross-Site Request Forgery CSRF problem that allows Stored XSS. This means an attacker can trick a user into performing unintended...

PT-2024-36000

Name of the Vulnerable Software and Affected Versions: rails-html-sanitizer version 1.6.0 Description: There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer when used with Rails = 7.1.0. This issue may allow an attacker to inject content if HTML5 sanitization...

PT-2024-35999

Name of the Vulnerable Software and Affected Versions: rails-html-sanitizer version 1.6.0 Description: A possible XSS vulnerability exists with certain configurations of Rails::HTML::Sanitizer when used with Rails = 7.1.0. This vulnerability may allow an attacker to inject content if HTML5...

WordPress plugin Document & Data Automation 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2024-35998

Name of the Vulnerable Software and Affected Versions: rails-html-sanitizer version 1.6.0 Description: A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has...

WordPress Grey Owl Lightbox plugin <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Grey Owl Lightbox versions = 1.6.1...

CVE-2024-11440 Grey Owl Lightbox <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Grey Owl Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'golbutton' shortcode in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

WordPress plugin Grey Owl Lightbox 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Apache HertzBeat Information Disclosure Vulnerability

Apache HertzBeat is a tool from the American company Apache Apache that can monitor various components. An information disclosure vulnerability exists in Apache HertzBeat versions prior to 1.6.1, which can be exploited by an attacker to obtain sensitive token information...

Apache HertzBeat Command Injection Vulnerability

Apache HertzBeat is a tool from the American company Apache Apache that can monitor various components. A command injection vulnerability exists in Apache HertzBeat versions prior to 1.6.1, which stems from the application's failure to properly filter constructed command special characters,...

PT-2024-16995 · WordPress · Grey Owl Lightbox

Name of the Vulnerable Software and Affected Versions: The Grey Owl Lightbox plugin for WordPress versions up to, and including, 1.6.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'gol button' shortcode due to insufficient input sanitization and output escapin...

PT-2024-35287 · Unknown · Corporate Zen Contact Page With Google Map

Name of the Vulnerable Software and Affected Versions: Corporate Zen Contact Page With Google Map versions 1.6.1 and earlier Description: The issue is related to a Path Traversal vulnerability, specifically a '.../...//' vulnerability, which affects the Corporate Zen Contact Page With Google Map...

WordPress Contact Page With Google Map plugin <= 1.6.1 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Contact Page With Google Map versions = 1.6.1...

CVE-2024-45791 Apache HertzBeat: Exposure sensitive token via http GET method with query string

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue...

CVE-2024-45791 Apache HertzBeat: Exposure sensitive token via http GET method with query string

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue...

CVE-2024-45505

CVE-2024-45505 concerns Apache HertzBeat (incubating) prior to 1.6.1, where an improper neutralization of special elements enables a Command Injection. The vulnerability affects execution paths that process constructed commands, allowing an attacker with network access (and with low privileges) t...