CVE-2024-4866

CVE-2024-4866 affects the UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS, Woo Widget, Menu Builder, Anywhere Elementor Shortcode) for WordPress. According to Red Hat and Wordfence data, all versions up to 1.1.6 are vulnerable to a Stored Cross-Site Scripting condit...

IBM Security QRadar Security Vulnerabilities

IBM Security QRadar is a modernized threat detection and response solution from International Business Machines IBM, Inc. designed to unify and integrate the security analyst experience and improve their response speed throughout the incident lifecycle. A security vulnerability exists in IBM...

The vulnerability of the RoundCube Webmail email client stems from insufficient protection of the website’s structure, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the RoundCube Webmail email client is related to insufficient protection of the website’s structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using SVG element animation attributes...

CVE-2024-4862

The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-3603 OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'osmmap' shortcode in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes such as 'theme'. This makes it possible...

WordPress Genesis Blocks plugin <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sharing Block Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Sharing Block Attributes vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Genesis Blocks versions = 3.1.3...

CVE-2024-5881

CVE-2024-5881 affects the Webico Slider Flatsome Addons plugin for WordPress. It enables a Stored Cross-Site Scripting (XSS) flaw in the plugin’s wbc_image shortcode due to insufficient input sanitization and output escaping. The vulnerability impacts all versions up to and including 2.0.1 . Expl...

Cross-Site Scripting (XSS)

railsadmin is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improperly-escaped HTML title attributes in the RailsAdmin list view, which can allow attackers to inject malicious scripts. Note: While 3.1.3 is the safe version, its recommended to upgrade to 3.1.4 as the 3.1.3...

Cross Site Scripting (XSS)

zendframework/zend-form is vulnerable to Cross Site Scripting XSS. The vulnerability is due to the use of the escapeHtml helper instead of escapeHtmlAttr, leading to improper escaping of HTML attributes. An attacker can exploit this by injecting malicious code through user data or JavaScript in...

CVE-2024-2926

The CVE-2024-2926 entry concerns the Elementor Addons by Livemesh WordPress plugin (versions up to and including 8.3.7). A Stored Cross-Site Scripting (XSS) vulnerability exists due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin’s widgets. Exploit...

CVE-2024-3638

CVE-2024-3638 affects Elementor Addons by Livemesh (WordPress). Stored XSS via Marquee Text, Testimonials, and Testimonial Slider widgets in all versions

PT-2024-22841 · Livemesh · Elementor Addons

Name of the Vulnerable Software and Affected Versions: Elementor Addons by Livemesh plugin for WordPress versions up to, and including, 8.3.7 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's widgets, allowing...

CVE-2024-6340

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CBL Mariner 2.0 Security Update: kernel (CVE-2020-27815)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-27815 advisory. - A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the abili...

jinja2: accepts keys containing non-attribute characters

A flaw was found in jinja2. The xmlattr filter accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each would then be interpreted as starting a separate attribute. If an application accepts keys as opposed to only values as user input, and...

CVE-2024-39305 Envoy Proxy use after free when route hash policy is configured with cookie attributes

Envoy is a cloud-native, open source edge and service proxy. Prior to versions 1.30.4, 1.29.7, 1.28.5, and 1.27.7. Envoy references already freed memory when route hash policy is configured with cookie attributes. Note that this vulnerability has been fixed in the open as the effect would be...

WordPress Gutenberg Blocks with AI by Kadence WP plugin <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via HTML Data Attributes vulnerability discovered by Webbernaut in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.2.45...

GeoServer Security Vulnerabilities

GeoServer is GeoServer open source an open source software server written in Java. It allows users to share and edit geospatial data. A security vulnerability exists in GeoServer that stems from the fact that GeoServer lists all environment variables and Java attributes to users with administrati...

PT-2024-5888 · Envoy +1 · Envoy +1

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.30.4 Envoy versions prior to 1.29.7 Envoy versions prior to 1.28.5 Envoy versions prior to 1.27.7 Description: The issue is related to a use-after-free error in the Envoy proxy server module. Exploitation of this iss...

Cross-site Scripting (XSS)

zendframework/zendframework is vulnerable to Cross-site Scripting XSS. The vulnerability is due to view helpers using escapeHtml instead of escapeHtmlAttr to escape HTML attributes, which can lead to potential XSS attack vectors when user data or JavaScript is used...