CVE-2024-35666

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Themesflat Themesflat Addons For Elementor allows Stored XSS.This issue affects Themesflat Addons For Elementor: from n/a through 2.1.2...

WordPress Themesflat Addons For Elementor Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Themesflat Addons For Elementor Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35666 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1d5882ba1544 Credits Khalid Yusuf Required...

GHSA-PP7V-WXX9-HM6R Thelia BackOffice default template vulnerable to Cross-site Scripting

The BackOffice of Thelia error.html template has a cross-site scripting vulnerability in version 2.1.0 and 2.1.1 but not version 2.0.X. Version 2.1.2 contains a patch for the issue...

PT-2024-40404 · Thelia · Thelia

Name of the Vulnerable Software and Affected Versions: Thelia versions 2.1.0 through 2.1.1 Description: The BackOffice of Thelia has a cross-site scripting issue in the error.html template. Recommendations: For versions 2.1.0 and 2.1.1, update to version 2.1.2 to resolve the issue...

PT-2024-40295 · Thelia · Thelia

Name of the Vulnerable Software and Affected Versions: thelia/thelia versions 2.1.0-beta1 through 2.1.2 Description: An authentication bypass issue was identified, affecting both customer and admin authentication. Recommendations: For thelia/thelia versions 2.1.0-beta1 through 2.1.2, update to...

WordPress PopupAlly Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)

Software PopupAlly Type Plugin Vulnerable versions = 2.1.1 Fixed in 2.1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34796 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID d37861f72276 Credits alfido osdie Patchstack Alliance Required...

WordPress PopupAlly Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)

Software PopupAlly Type Plugin Vulnerable versions = 2.1.1 Fixed in 2.1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33639 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ac9794d90ae4 Credits Manab Jyoti Dowarah Required privilege...

WordPress Elespare Plugin <= 2.1.2 is vulnerable to Broken Access Control

Software Elespare Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.1.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0900 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f7ab94a6cab5 Credits Lucio Sá Required privilege Subscribe...

PT-2024-24009 · Elex · Elex Woocommerce Dynamic Pricing/Discounts

Name of the Vulnerable Software and Affected Versions: ELEX WooCommerce Dynamic Pricing and Discounts versions 2.1.2 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, which could potentially allow unauthorized actions to be performed on behalf of a user...

WordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ELEX WooCommerce Dynamic Pricing and Discounts versions = 2.1.2...

PT-2024-24411 · Elex · Elex Woocommerce Dynamic Pricing/Discounts

Name of the Vulnerable Software and Affected Versions: ELEX WooCommerce Dynamic Pricing and Discounts versions n/a through 2.1.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. It affects the ELEX WooCommerce Dynamic Pricing and Discounts plugin. Recommendations: For...

PT-2024-23898 · Elex · Elex Woocommerce Dynamic Pricing/Discounts

Name of the Vulnerable Software and Affected Versions: ELEX WooCommerce Dynamic Pricing and Discounts versions through 2.1.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables...

WordPress Plugin Coming Soon, Under Construction & Maintenance Mode By Dazzler Security Breach

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

BIT-TENSORFLOW-2020-15210 Segmentation fault in tensorflow-lite

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b a...

BIT-AIRFLOW-2021-35936 No Authentication on Logging Server

If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...

BIT-HARBOR-2020-29662

In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path...

AZL-35554 CVE-2024-24786 affecting package blobfuse2 for versions less than 2.1.2-7

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

Out-of-bounds

A vulnerability was found in Ctcms 2.1.2. It has been declared as critical. This vulnerability affects unknown code of the file ctcms/apps/controllers/admin/Upsys.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The complexity of an attack is rather high...

CVE-2024-1925 Ctcms Upsys.php unrestricted upload

A vulnerability was found in Ctcms 2.1.2. It has been declared as critical. This vulnerability affects unknown code of the file ctcms/apps/controllers/admin/Upsys.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The complexity of an attack is rather high...

CVE-2024-1925

CVE-2024-1925 affects Ctcms 2.1.2 in the Upsys.php admin controller, enabling unrestricted file upload. The vulnerability is exploitable remotely with high attack complexity; exploitation is reported publicly. No patch/version fix details are provided in the connected documents. Some sources reco...