CVE-2024-9344: Improper Neutralization of Input During Web Page Generation

The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.1.1 due to insufficient input...

PT-2024-18945 · Unknown · Git-Shallow-Clone

Name of the Vulnerable Software and Affected Versions: git-shallow-clone versions all Description: The issue is related to command injection due to missing sanitization or mitigation flags in the process variable of the gitShallowClone function. This allows for potential argument injection. No...

Exploit for CVE-2024-9162

CVE-2024-9162 All-in-One WP Migration and Backup SELECT op...

CVE-2024-8668: Improper Neutralization of Input During Web Page Generation

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution formerly WooLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the tooltip and countdown functionality in all versions up to, and including, 2.9.7 due to insufficient input...

Alisonic Sibylla

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Alisonic Equipment: Sibylla Vulnerability: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' 2. RISK EVALUATION Successful exploitation of this vulnerability...

Exploit for CVE-2022-2546

All-in-One WP Migration " Affect...

SUSE CVE-2024-46798

In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix UAF for sndsocpcmruntime object When using kernel with the following extra config, - CONFIGKASAN=y - CONFIGKASANGENERIC=y - CONFIGKASANINLINE=y - CONFIGKASANVMALLOC=y - CONFIGFRAMEWARN=4096 kernel detects that...

Ubuntu: Security Advisory (USN-7008-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

org.glassfish.main.appclient:gf-client (5.1.0-rc2), org.glassfish.main.appclient:gf-client-module (5.1.0-rc2) +15 more potentially affected by CVE-2024-8646 via org.glassfish.main.web:web-core (5.1.0-rc2)

org.glassfish.main.web:web-core MAVEN version 5.1.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.web:web-core and may be impacted: - org.glassfish.main.appclient:gf-client 5.1.0-rc2 -...

org.glassfish.main.appclient:gf-client (6.2.2), org.glassfish.main.appclient:gf-client-module (6.2.2) +14 more potentially affected by CVE-2024-8646 via org.glassfish.main.web:web-core (6.2.2)

org.glassfish.main.web:web-core MAVEN version 6.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.web:web-core and may be impacted: - org.glassfish.main.appclient:gf-client 6.2.2 - org.glassfish.main.appclient:gf-client-module 6.2....

org.glassfish.main.appclient:gf-client (6.2.5), org.glassfish.main.appclient:gf-client-module (6.2.5) +15 more potentially affected by CVE-2024-8646 via org.glassfish.main.web:web-core (6.2.5)

org.glassfish.main.web:web-core MAVEN version 6.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.web:web-core and may be impacted: - org.glassfish.main.appclient:gf-client 6.2.5 - org.glassfish.main.appclient:gf-client-module 6.2....

org.glassfish.main.appclient:gf-client (>=7.0.0-m1, <=7.0.9), org.glassfish.main.appclient:gf-client-module (>=7.0.0-m1, <=7.0.9) +16 more potentially affected by CVE-2024-8646 via org.glassfish.main.web:web-core (>=7.0.0-m1, <=7.0.9)

org.glassfish.main.web:web-core MAVEN version =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.0-m2, =7.0.0-m1, =7.0.0-m1, =7.0.0-m10, =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.9 and more Source cves: CVE-2024-8646 Source advisory:...

AZL-48984 CVE-2024-23185 affecting package dovecot 2.3.20-1

Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up "fullvalue" buffer out of the smaller chunks. The fullvalue buffer has no si...

CVE-2024-21528

All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations function in gettext.js due to improper user input sanitization...

GHSA-MQM9-C95H-X2P6 AngularJS allows attackers to bypass common image source restrictions

Improper sanitization of the value of the srcset attribute in HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/ContentSpoofing . This issue affects all versions of...

PT-2024-39037 · Unknown · Job Portal

Name of the Vulnerable Software and Affected Versions: Job Portal affected versions not specified Description: The issue allows an attacker to send a specially designed query through the CATEGORY parameter in the "/jobportal/admin/vacancy/controller.php" API endpoint, and retrieve all the...

WordPress plugin WP Extended 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

AZL-48581 CVE-2024-45310 affecting package kubernetes 1.28.4-25

runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers an...

CVE-2024-43964

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Michael Leithold DSGVO All in one for WP allows Stored XSS.This issue affects DSGVO All in one for WP: from n/a through 4.5...

CVE-2024-43964

CVE-2024-43964 is a stored cross-site scripting vulnerability in the WordPress plugin DSGVO All in one for WP . According to the provided references, the issue arises from improper neutralization of input during web page generation, allowing stored XSS. Affected versions are listed as from n/a th...