CVE-2024-29094 WordPress HT Easy GA4 plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HasThemes HT Easy GA4 Google Analytics 4 allows Stored XSS.This issue affects HT Easy GA4 Google Analytics 4 : from n/a through 1.1.7...

CVE-2024-29094

CVE-2024-29094 relates to HT Easy GA4 (HasThemes) for WordPress, vulnerability type: Stored XSS due to Improper Neutralization of Input During Web Page Generation. Affected software: HT Easy GA4 (Google Analytics 4) plugin; affected range: from n/a through version 1.1.7. The impact is stored cros...

AZL-35909 CVE-2024-22025 affecting package nodejs for versions less than 16.20.2-4

A vulnerability in Node.js has been identified, allowing for a Denial of Service DoS attack through resource exhaustion when using the fetch function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch function in Node.js always decodes Brotli, making i...

UPS Network Management Card 4 - Path Traversal Vulnerability

Exploit Title: UPS Network Management Card 4 - Path Traversal Google Dork: inurl:nmc inurl:logon.htm Exploit Author: Víctor García Vendor Homepage: https://www.apc.com/ Version: 4 Tested on: Kali Linux CVE: N/A PoC: curl -k...

UPS Network Management Card 4 - Path Traversal

Exploit Title: UPS Network Management Card 4 - Path Traversal Google Dork: inurl:nmc inurl:logon.htm Date: 2023-12-19 Exploit Author: Víctor García Vendor Homepage: https://www.apc.com/ Version: 4 Tested on: Kali Linux CVE: N/A PoC: curl -k...

WordPress HT Easy GA4 ( Google Analytics 4 ) Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)

Software HT Easy GA4 Google Analytics 4 Type Plugin Vulnerable versions = 1.1.7 Fixed in 1.1.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29094 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8f8e72c6e71d Credits Yudistira Arya...

CVE-2024-1203

The Conversios – Google Analytics 4 GA4, Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'valueData' parameter in all versions up to, and including, 7.0.7 due to insufficient escaping on the user supplied parameter and lack of...

Sql injection

The Conversios – Google Analytics 4 GA4, Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'valueData' parameter in all versions up to, and including, 6.9.1 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2024-1203

CVE-2024-1203 involves the Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce WordPress plugin. The root cause is insufficient escaping and improper preparation of SQL queries in the valueData parameter, enabling authenticated attackers with subscriber...

CVE-2024-1203 Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce <= 7.0.7 - Authenticated (Subscriber+) SQL Injection

The Conversios – Google Analytics 4 GA4, Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'valueData' parameter in all versions up to, and including, 7.0.7 due to insufficient escaping on the user supplied parameter and lack of...

nexus-4.es Cross Site Scripting vulnerability OBB-3870592

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

4-shoes.ru Cross Site Scripting vulnerability OBB-3870060

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Jailbreaking LLMs with ASCII Art

Researchers have demonstrated that putting words in ASCII art can cause LLMs--GPT-3.5, GPT-4, Gemini, Claude, and Llama2--to ignore their safety instructions. Research paper...

AZL-38602 CVE-2024-1441 affecting package libvirt for versions less than 10.0.0-4

An off-by-one error flaw was found in the udevListInterfacesByStatus function in libvirt when the number of interfaces exceeds the size of the names array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of...

CVE-2024-25845

The CD Custom Fields 4 Orders (cdcustomfields4orders) module for PrestaShop by Cleanpresta.com is vulnerable to SQL injection in versions 1.0.0 and earlier . A guest can exploit this flaw to perform malicious actions by leveraging improper neutralization of special elements in SQL commands. To re...

CVE-2024-25845

In the module "CD Custom Fields 4 Orders" cdcustomfields4orders = 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL injection in affected versions...

[SECURITY] Fedora 40 Update: vecmath1.2-1.14-36.fc40

This is an unofficial implementation java source code of the javax.vecmath package specified in the JavaTM 3D API 1.2 . The package includes classes for 3-space vector/point, 4-space vector, 4x4, 3x3 matrix, quaternion, axis-angle combination and etc. which are often utilized for computer graphic...

[SECURITY] Fedora 40 Update: postgresql-jdbc-42.7.1-4.fc40

PostgreSQL is an advanced Object-Relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database...

[SECURITY] Fedora 40 Update: javassist-3.30.2-4.fc40

Javassist enables Java programs to define a new class at runtime and to modify a class file when the JVM loads it. Unlike other similar bytecode editors, Javassist provides two levels of API: source level and bytecode level. If the users use the source-level API, they can edit a class file withou...

pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user

pgAdmin prior to version 8.4 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is...