WordPress Contact Form 7 - Repeatable Fields Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form 7 - Repeatable Fields Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.0.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10180 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d39a0f706c9a Credits Pete...

PT-2024-16095

Name of the Vulnerable Software and Affected Versions Contact Form 7 – Repeatable Fields plugin for WordPress versions up to, and including, 2.0.1 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the field group shortcode. This...

CVE-2024-10180: Improper Neutralization of Input During Web Page Generation

The Contact Form 7 – Repeatable Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fieldgroup shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

AZL-51693 CVE-2024-10041 affecting package pam for versions less than 1.5.1-7

A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input stdin. As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This fla...

Drupal Smartling Connector module < 7.x-4.19,< 7.x-3.8 - Authenticated Open Redirection vulnerability

Authenticated Open Redirection vulnerability discovered by Pierre Rudloff in WordPress Module Smartling Connector versions 7.x-4.19,7.x-3.8...

Drupal Loft Data Grids module < 7.x-2.7,< 7.x-3.0 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability discovered by Juraj Nemec in WordPress Module Loft Data Grids versions 7.x-2.7,7.x-3.0...

RHEL 7 : NetworkManager-libreswan (RHSA-2024:8357)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:8357 advisory. This package contains software for integrating the libreswan VPN software with NetworkManager and the GNOME desktop Security Fixes:...

RHEL 7 : python-idna (RHSA-2024:8365)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:8365 advisory. The hsakmt packages include a thunk library for AMD's Heterogeneous System Architecture HSA Linux kernel driver amdkfd. Security Fixes: python-idna:...

Oracle Linux 8 : NetworkManager-libreswan (ELSA-2024-8353)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-8353 advisory. 1.2.10-7 - Unbreak validation of unknown keys 1.2.10-6 - Fix improper escaping of Libreswan configuration CVE-2024-9050 Tenable has extracted the preceding...

Drupal Loft Data Grids module < 7.x-2.7,< 7.x-3.0 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by Juraj Nemec in WordPress Module Loft Data Grids versions 7.x-2.7,7.x-3.0...

Smartling Connector - Less critical - Multiple vulnerabilities - SA-CONTRIB-2024-053

Smartling module allows you to translate content in Drupal 7 using the Smartling Translation Management Platform. The module includes an outdated version of the Guzzle package guzzlehttp/guzzle 6.3.3, which has known security vulnerabilities...

Drupal Smartling Connector module < 7.x-4.19,< 7.x-3.8 - Authenticated Open Redirection vulnerability

Authenticated Open Redirection vulnerability discovered by Pierre Rudloff in WordPress Module Smartling Connector versions 7.x-4.19,7.x-3.8...

Drupal Loft Data Grids module < 7.x-2.7,< 7.x-3.0 - Authenticated Content Injection vulnerability

Authenticated Content Injection vulnerability discovered by Juraj Nemec in WordPress Module Loft Data Grids versions 7.x-2.7,7.x-3.0...

Oracle Linux 7 / 8 / 9 : linux-firmware (ELSA-2024-12797)

The remote Oracle Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12797 advisory. 20241003-999.35.git95bfe086.el8 - Rebase to latest upstream Orabug: 37132142 - Fix build error in ol7 due to linking in copy-firmware.sh Orabu...

virt:kvm_utils1 security update

hivex 1.3.18-21 - Bounds check for block exceeding page length CVE-2021-3504 resolves: rhbz1950501 1.3.18 - Resolves: bz1810193 Upgrade components in virt:rhel module:stream for RHEL-8.3 release 1.3.18 - Resolves: bz1810193 Upgrade components in virt:rhel module:stream for RHEL-8.3 release 1.3.15...

Drupal Smartling Connector module < 7.x-4.19,< 7.x-3.8 - Unauthenticated Open Redirection vulnerability

Unauthenticated Open Redirection vulnerability discovered by Pierre Rudloff in WordPress Module Smartling Connector versions 7.x-4.19,7.x-3.8...

Drupal Loft Data Grids module < 7.x-2.7,< 7.x-3.0 - Unauthenticated Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure vulnerability discovered by Juraj Nemec in WordPress Module Loft Data Grids versions 7.x-2.7,7.x-3.0...

Drupal Smartling Connector module < 7.x-4.19,< 7.x-3.8 - Administrator+ Multiple Vulnerabilities

Administrator+ Multiple Vulnerabilities discovered by Pierre Rudloff in WordPress Module Smartling Connector versions 7.x-4.19, 7.x-3.8...

RHEA-2024:1143 Red Hat Enhancement Advisory: redis:7 update

Bulletin has no description...

RHEL 7 : NetworkManager-libreswan (RHSA-2024:8338)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:8338 advisory. This package contains software for integrating the libreswan VPN software with NetworkManager and the GNOME desktop Security Fixes:...