WordPress plugin CWD 3D Image Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-48426

A flaw was found in the Asset Import Library Assimp. A maliciously crafted 3D model file can trigger this segmentation fault, causing the application to crash. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security...

CVE-2024-48425

A flaw was found in the Assimp asset import library. An attacker may be able to trigger a segmentation fault using specially-crafted 3D model files. This can result in a denial of service due to invalid memory access. Mitigation Mitigation for this issue is either not available or the currently...

CVE-2024-48425

A segmentation fault SEGV was detected in the Assimp::SplitLargeMeshesProcessTriangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a...

CVE-2024-48423

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library...

CVE-2024-48424

A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp library, specifically during the processing of OpenGEX files...

CVE-2024-48426

A segmentation fault SEGV was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz testing with AddressSanitizer. The crash occurred due to a read access to an invalid memory address 0x1000c9714971...

CVE-2024-8717 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip <= 2.3.32 - Reflected Cross-Site Scripting

The PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pdfsource' parameter in all versions up to, and including, 2.3.32 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-49657

Missing Authorization vulnerability in Renata Bracichowicz 3D Work In Progress renee-work-in-progress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D Work In Progress: from n/a through = 1.0.3...

CVE-2024-49652 WordPress 3D Work In Progress plugin <= 1.0.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Renata Bracichowicz 3D Work In Progress renee-work-in-progress allows Upload a Web Shell to a Web Server.This issue affects 3D Work In Progress: from n/a through = 1.0.3...

CVE-2024-49652

CVE-2024-49652 concerns the WordPress plugin ReneeCussack 3D Work In Progress (versions n/a through 1.0.3). The vulnerability is an Unrestricted Upload of File with Dangerous Type, enabling an attacker to upload a web shell to the web server. According to Patchstack, this is a high-severity issue...

CVE-2024-49657 WordPress 3D Work In Progress plugin <= 1.0.3 - Arbitrary File Deletion vulnerability

Missing Authorization vulnerability in Renata Bracichowicz 3D Work In Progress renee-work-in-progress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D Work In Progress: from n/a through = 1.0.3...

CVE-2024-49657

CVE-2024-49657 : WordPress plugin “3D Work In Progress” (RenéeCussack)

The vulnerability of the Substance 3D Stager software lies in its susceptibility to overflowing buffer spaces, allowing attackers to execute arbitrary code.

The vulnerability of the Substance 3D Stager software lies in the overflow of the buffer based on a queue. Exploiting this vulnerability allows an attacker to execute arbitrary code in the context of the current user, using a specially created file...

The vulnerability of the Substance 3D Stager software lies in its software, which is exposed due to a buffer overflow in the dynamic memory. This allows an attacker to execute arbitrary code.

The vulnerability of the Substance 3D Stager software lies in the overflow of memory buffer in dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code in the context of the current user, using a specially created file...

Adobe Substance 3D Sampler Null Pointer Dereference Vulnerability

Adobe Substance 3D Sampler is a photogrammetry software from the American company Audobee Adobe. It is used to convert photographic captures and scanned images into 3D texture and material assets. A null pointer dereference vulnerability exists in Adobe Substance 3D Sampler 4.5 and earlier...

WordPress CWD 3D Image Gallery plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin CWD 3D Image Gallery versions = 1.0...

WordPress 3D Work In Progress Plugin <= 1.0.3 is vulnerable to Arbitrary File Upload

Software 3D Work In Progress Type Plugin Vulnerable versions = 1.0.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-49652 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 22382aa9215e Credits stealthcopter Required privilege...

WordPress CWD 3D Image Gallery Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software CWD 3D Image Gallery Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49632 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ff9d4857fb07 Credits João Pedro S Alcântara Kinorth...

WordPress 3D Work In Progress Plugin <= 1.0.3 is vulnerable to Arbitrary File Deletion

Software 3D Work In Progress Type Plugin Vulnerable versions = 1.0.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Deletion CVE CVE-2024-49657 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 209728d5f5a9 Credits stealthcopter Required privilege...