554 matches found
PT-2024-28733 · WordPress · Amen
Name of the Vulnerable Software and Affected Versions: Amen WordPress plugin versions 3.3.1 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape som...
CraftCMS Security Vulnerability
CraftCMS is a content management system from CraftCMS, Inc. A security vulnerability exists in the CraftCMS plugin Two-Factor Authentication version 3.3.1, version 3.3.2, and version 3.3.3, which stems from a vulnerability that allows for multiple reuse of TOTP tokens during the validity period...
CraftCMS Security Vulnerability
CraftCMS is a content management system from CraftCMS, Inc. A security vulnerability exists in CraftCMS plugin Two-Factor Authentication version 3.3.1, 3.3.2, and 3.3.3, which stems from a vulnerability that allows disclosure of a user's password hash...
OESA-2024-1610 ruby security update
Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks such as Perl. Security Fixes: An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the...
OpenSSL 3.3.0 < 3.3.1 Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 3.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.3.1 advisory. - Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the function...
eZ Platform Bundled jQuery affected by CVE-2019-11358
In eZ Platform 2.x, ezsystems/ezplatform-admin-ui-assets before v4.2.0 includes jQuery version 3.3.1. This version of jQuery is affected by the security vulnerability https://www.cvedetails.com/cve/CVE-2019-11358/ This is fixed in jQuery version 3.4. We recommend that you upgrade your...
DEBIAN-CVE-2024-27282
An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1...
CVE-2024-27282
An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1...
An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler it is possible to extract arbitrary heap data relative to the start of the text including pointers and sensitive strings. The fixed versions are 3.0.7 3.1.5 3.2.4 and 3.3.1.
...
WordPress Content Blocks (Custom Post Widget) Plugin <= 3.3.0 is vulnerable to Cross Site Scripting (XSS)
Software Content Blocks Custom Post Widget Type Plugin Vulnerable versions = 3.3.0 Fixed in 3.3.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34566 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c437cf336c56 Credits Ngô Thiên An ancorn...
CVE-2024-31426
Cross-Site Request Forgery CSRF vulnerability in Data443 Inline Related Posts.This issue affects Inline Related Posts: from n/a through 3.3.1...
CVE-2024-31426 WordPress Inline Related Posts plugin <= 3.3.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Data443 Inline Related Posts.This issue affects Inline Related Posts: from n/a through 3.3.1...
CVE-2024-31426 WordPress Inline Related Posts plugin <= 3.3.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Data443 Inline Related Posts.This issue affects Inline Related Posts: from n/a through 3.3.1...
PT-2024-24067 · Data443 · Data443 Inline Related Posts
Name of the Vulnerable Software and Affected Versions: Data443 Inline Related Posts versions 3.3.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...
WordPress MasterStudy LMS Plugin <= 3.3.1 is vulnerable to Privilege Escalation
Software MasterStudy LMS Type Plugin Vulnerable versions = 3.3.1 Fixed in 3.3.2 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-2409 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 8dbe36bee6fd Credits Hiroho...
PT-2024-20262 · WordPress · Masterstudy Lms
Name of the Vulnerable Software and Affected Versions: MasterStudy LMS plugin for WordPress versions up to, and including, 3.3.1 Description: The issue is due to insufficient validation checks within the register user function called by the 'wp ajax nopriv stm lms register' AJAX action. This allo...
VulnCheck KEV: CVE-2024-27987
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through = 3.3.1...
PT-2024-22184 · Givewp · Givewp
Name of the Vulnerable Software and Affected Versions: GiveWP Give versions n/a through 3.3.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inject...
WordPress GiveWP Plugin <= 3.3.1 is vulnerable to Cross Site Scripting (XSS)
Software GiveWP Type Plugin Vulnerable versions = 3.3.1 Fixed in 3.4.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27987 Patch priority Medium CVSS severity Medium 7.1 Developer Liquid Web / StellarWP PSID 221b899ac821 Credits Rafie Muhammad Patchstack Required...