CVE-2024-31102

CVE-2024-31102 is an input‑sanitization issue in the WordPress plugin Prenotazioni (by Scimone Ignazio) that allows Stored XSS via improper neutralization of input during web page generation. Affected range: Prenotazioni versions up to 1.7.4 (no details on fixed versions provided). Impact per the...

PT-2024-23771 · Unknown · Scimone Ignazio Prenotazioni

Name of the Vulnerable Software and Affected Versions: Scimone Ignazio Prenotazioni versions 1.7.4 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Stored Cross-site Scripting XSS vulnerability. This allows for the...

WordPress Prenotazioni plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Faizal Abroni Patchstack Alliance in WordPress Plugin Prenotazioni versions = 1.7.4...

Qdrant 路径遍历漏洞

Qdrant is a vector similarity search engine and vector database. A path traversal vulnerability exists in Qdrant, which stems from a path traversal vulnerability in the component Full Snapshot REST API. Affected products and versions: Qdrant 1.6.1 and earlier, 1.7.4 and earlier, 1.8.2 and earlier...

WordPress Prenotazioni Plugin <= 1.7.4 is vulnerable to Cross Site Scripting (XSS)

Software Prenotazioni Type Plugin Vulnerable versions = 1.7.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31102 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 02e6f4bc0952 Credits Faizal Abroni Required privilege...

Design/Logic Flaw

HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. Fixed in Nomad 1.7.4, 1.6.7, 1.5.14...

CVE-2024-1329 Nomad Vulnerable to Arbitrary Write Through Symlink Attack

HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14...

PT-2024-11522 · WordPress · Contact Form & Lead Form Elementor Builder

Name of the Vulnerable Software and Affected Versions: Contact Form & Lead Form Elementor Builder WordPress plugin versions prior to 1.7.4 Description: The issue is related to the lack of authorisation and nonce checks in the plugin, which could allow any authenticated users, such as subscribers,...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to a flaw in the handling of certain data inputs. An attacker can cause a denial of service by sending specially crafted data to the application. Details Denial of Service DoS describes a family of attacks, all...

DEBIAN-CVE-2023-43643

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the...

UBUNTU-CVE-2023-43643

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the...

CVE-2023-43643

CVE-2023-43643 concerns AntiSamy, a library for cleansing HTML. The connected documents confirm a mutation XSS (mXSS) vulnerability in Ant iSamy prior to 1.7.4 when preserveComments is enabled and certain tags are allowed, allowing crafted inputs to make comment-tag elements executable in sanitiz...

OWASP AntiSamy Cross-Site Scripting Vulnerability

OWASP AntiSamy is a library for HTML and CSS coding from the OWASP Foundation in the United States. A cross-site scripting vulnerability exists in OWASP AntiSamy versions prior to 1.7.4 that stems from an error in parsing cleaned HTML, where certain inputs may cause elements in comment tags to be...

Design/Logic Flaw

shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping or quoting for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expecte...

shescape 安全漏洞

Shescape is open source a simple shell escaping program package for JavaScript . Use it to escape user-controlled input to shell commands to prevent shell injection. A security vulnerability exists in versions of shescape prior to 1.7.4 that stems from escaping or referencing the wrong shell,...

PT-2023-27313 · Shescape · Shescape

Name of the Vulnerable Software and Affected Versions: Shescape versions prior to 1.7.4 Description: The issue affects users of Shescape on Windows in a threaded context, allowing attackers to bypass protections by exploiting Shescape's failure to correctly escape for the expected shell. This can...

CVE-2023-36212

File Upload vulnerability in Total CMS v.1.7.4 allows a remote attacker to execute arbitrary code via a crafted PHP file to the edit page function...

CVE-2023-36212

File Upload vulnerability in Total CMS v.1.7.4 allows a remote attacker to execute arbitrary code via a crafted PHP file to the edit page function...

Total CMS 代码问题漏洞

Total CMS is an online editing solution from Total CMS Open Source. A file upload vulnerability exists in Total CMS version 1.7.4, which stems from the lack of validation of uploaded files by the edit page feature. The vulnerability can be exploited to remotely execute arbitrary code by uploading...

Total CMS 1.7.4 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...