6950 matches found
CVE-2024-2170
VK All in One Expansion Unit (WordPress) is vulnerable to Stored Cross-Site Scripting via the child page index widget in versions up to 9.96.0.1 due to insufficient input sanitization and output escaping on user-supplied attributes such as 'className'. The issue can be triggered by authenticated ...
VK All in One Expansion Unit < 9.96.0.0 - Unauthenticated Password Protected Content Access
Description The plugin is vulnerable to Sensitive Information Exposure via social meta tags, allowing unauthenticated attackers to view limited password protected content...
WordPress VK All in One Expansion Unit Plugin <= 9.96.0.1 is vulnerable to Cross Site Scripting (XSS)
Software VK All in One Expansion Unit Type Plugin Vulnerable versions = 9.96.0.1 Fixed in 9.97.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2170 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 26bb3cd6172a Credits Ngô...
CVE-2024-2170: Improper Neutralization of Input During Web Page Generation
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the child page index widget in all versions up to, and including, 9.96.0.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'className.' This makes ...
WordPress VK All in One Expansion Unit Plugin <= 9.95.0.1 is vulnerable to Sensitive Data Exposure
Software VK All in One Expansion Unit Type Plugin Vulnerable versions = 9.95.0.1 Fixed in 9.96.0.0 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-2093 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d4653e32a362 Credits Krzyszt...
VK All in One Expansion Unit < 9.97.0.0 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its child page index widget options such as className before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
WordPress Plugin VK All in One Expansion Unit 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
CVE-2024-27967 WordPress DSGVO All in one for WP plugin <= 4.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Michael Leithold DSGVO All in one for WP.This issue affects DSGVO All in one for WP: from n/a through 4.3...
CVE-2024-27967: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Michael Leithold DSGVO All in one for WP.This issue affects DSGVO All in one for WP: from n/a through 4.3...
PT-2024-22172 · WordPress · Dsgvo All In One For Wp
Name of the Vulnerable Software and Affected Versions: DSGVO All in one for WP versions n/a through 4.3 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user without their knowledge or consent. Recommendations:...
CVE-2024-0337: URL Redirection to Untrusted Site
The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpayoutsredirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can...
PT-2024-21794
Name of the Vulnerable Software and Affected Versions Zulip versions 3.0 through 8.2 Description The issue arises when a user moves a Zulip message from a public stream to a private stream, and chooses to move just that single message. In such cases, active users without access to the private...
PT-2024-17001
Name of the Vulnerable Software and Affected Versions Devklan's Alma Blog versions 2.1.10 and earlier Description The issue allows a remote user to retrieve all valid users registered in the application by analyzing the request response. This could lead to information disclosure. Recommendations...
PT-2024-19959 · Fitnesse · Fitnesse
Name of the Vulnerable Software and Affected Versions: FitNesse versions all releases Description: A cross-site scripting issue exists, potentially allowing a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a lin...
PT-2024-22277
Name of the Vulnerable Software and Affected Versions FitNesse all releases Description The issue allows a remote authenticated attacker to execute arbitrary OS commands. Note that this behavior is claimed by a contributor to be a product specification rather than a vulnerability, and this is und...
DEBIAN-CVE-2021-47110
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Disable kvmclock on all CPUs on shutdown Currenly, we disable kvmclock from machineshutdown hook and this only happens for boot CPU. We need to disable it for all CPUs to guard against memory corruption e.g. on restore...
MAL-2024-1087 Malicious code in rat-patrol (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76425bdae39c104791dcaea76a06838a4ea7f3358370079dd8d2f40810f5b20d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2024-1503: Cross-Site Request Forgery (CSRF)
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the erasetutordata function. This makes it possible for unauthenticated...
SUSE SLES12: gstreamer-plugins-bad / gstreamer-plugins-bad-devel / etc (SUSE-SU-2024:0779-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0779-1 advisory. - CVE-2023-44446: Fixed use-after-free remote code execution vulnerability via MXF file bsc1217213. Tenable has extracted the preceding...
