CVE-2024-1957

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'giveform' shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This...

WordPress Plugin GiveWP 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security...

Canimaan Software LTD ClamXAV 安全漏洞

Canimaan Software LTD ClamXAV is a highly trusted anti-virus and malware scanner for MacOS from Canimaan Software. A security vulnerability exists in Canimaan Software LTD ClamXAV versions v3.1.2 through v3.6.1, which stems from a vulnerability that allows a local attacker to escalate privileges...

CVE-2024-31107

Technical details for CVE-2024-31107 are not provided in the supplied documents. Monitor for updates; current materials reference XSS broadly but do not specify affected versions, vectors, exploit status, or fixes.

PT-2024-23776 · Openid · Openid

Name of the Vulnerable Software and Affected Versions: OpenID versions through 3.6.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS attacks. Recommendations: For versions through...

WordPress WP Chat App Plugin <= 3.6.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Chat App Type Plugin Vulnerable versions = 3.6.1 Fixed in 3.6.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1761 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b848bc725213 Credits Ngô Thiên An ancorn Required...

PT-2024-18283 · WordPress · Wp Chat App

Name of the Vulnerable Software and Affected Versions: WP Chat App plugin for WordPress versions up to, and including, 3.6.1 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes such as buttonColor and phoneNumber. This allows...

BIT-GRAFANA-IMAGE-RENDERER-2022-31176 Grafana Image Renderer leaking files

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

Security Bulletin: IBM QRadar Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Assistant App for IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-38900 DESCRIPTION: decode-uri-component is...

WordPress lasTunes Plugin <= 3.6.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software lasTunes Type Plugin Vulnerable versions = 3.6.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-6499 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 87d3b56ef4f1 Credits Daniel Ruf Required privilege...

VulnCheck KEV: CVE-2022-0867

The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available to unauthenticated users...

CVE-2023-46725

FoodCoopShop is open source software for food coops and local shops. Versions starting with 3.2.0 prior to 3.6.1 are vulnerable to server-side request forgery. In the Network module, a manufacturer account can use the /api/updateProducts.json endpoint to make the server send a request to an...

Server side request forgery (ssrf)

FoodCoopShop is open source software for food coops and local shops. Versions starting with 3.2.0 prior to 3.6.1 are vulnerable to server-side request forgery. In the Network module, a manufacturer account can use the /api/updateProducts.json endpoint to make the server send a request to an...

CVE-2023-46725 FoodCoopShop Server-Side Request Forgery vulnerability

FoodCoopShop is open source software for food coops and local shops. Versions starting with 3.2.0 prior to 3.6.1 are vulnerable to server-side request forgery. In the Network module, a manufacturer account can use the /api/updateProducts.json endpoint to make the server send a request to an...

CVE-2020-27636

CVE-2020-27636 affects Microchip MPLAB Net 3.6.1, where TCP Initial Sequence Numbers (ISNs) are generated with insufficient randomness. This weak ISN generation can enable spoofing or disruption of TCP connections, with the CVSSv3 base score listed as 9.1 (CRITICAL) in NVD. The vulnerability is s...

Low: libarchive

Issue Overview: No CVE associated with this advisory Affected Packages: libarchive Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update libarchive or yum upda...

Security Bulletin: JSuites is vulnerable to cross-site scripting (CVE-2021-41086)

Summary CVE-2021-41086 JSuites is vulnerable to cross-site scripting Vulnerability Details CVEID:CVE-2021-41086 DESCRIPTION: jSuites is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the clipboard. A remote attacker could exploit this vulnerability to...

PrestaShop SQL注入漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image zoom. A security vulnerability exists in PrestaShop, which originates from a SQL injection vulnerability in the...

PT-2023-11889 · WordPress · Easy Testimonials

Name of the Vulnerable Software and Affected Versions: Easy Testimonials plugin for WordPress versions up to and including 3.6.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the saveCustomFields function. This allows unauthenticat...

PT-2023-17529 · WordPress · The Announcement & Notification Banner – Bulletin

Name of the Vulnerable Software and Affected Versions: The Announcement & Notification Banner – Bulletin plugin for WordPress versions up to, and including, 3.6.0 Description: The issue allows unauthorized access and modification of data due to a missing capability check on the bulletinwp update...