In GNU tar before 1.35 mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.

...

CVE-2024-11408

The Slotti Ajanvaraus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slotti' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11426

CVE-2024-11426: AutoListicle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the auto-list-number shortcode in all versions up to 1.2.3. The issue arises from insufficient input sanitization and output escaping on user-supplied attributes, enabling authenticated attackers wi...

CVE-2024-10886

The Tribute Testimonials – WordPress Testimonial Grid/Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tributetestimonialsslider' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: checked the validation of faultattrs in f2fsbuildfaultattr. It failed to check the validation of faultattrs in parseoptions; we will fix this by adding a check condition in f2fsbuildfaultattr. Also, use f2fsbuildfaultatt...

Improper Attribute Access

twig/twig is vulnerable to improper attribute access. The vulnerability is due to insufficient security checks via the property policy and the isset method on Array-like objects, allowing attackers to bypass the sandbox's security policy and access restricted attributes...

CVE-2024-11381 Control horas <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Control horas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'chregistro' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11381 Control horas <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Control horas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'chregistro' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11428

The Lazy load videos and sticky control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lazy-load-videos-and-sticky-control' shortcode in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-10172

The WPBakery Visual Composer WHMCS Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's voidwbwhmcselaoutssearch shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. Thi...

CVE-2024-10172 WPBakery Visual Composer WHMCS Elements <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via void_wbwhmcse_laouts_search Shortcode

The WPBakery Visual Composer WHMCS Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's voidwbwhmcselaoutssearch shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. Thi...

WordPress plugin Beds24 Online Booking has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability exis...

Cross-site Scripting (XSS)

Overview djangocms-attributes-field is an Adds attributes to Django models. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization of form Attributes fields in the Django CMS admin panel. An attacker can exploit this vulnerability through the...

django-cms-qe (>=1.4.3, <=2.2.0), django-danceschool (>=0.6.2, <=0.8.3) +1 more potentially affected by CVE-2024-11406 via djangocms-attributes-field (1.2.0)

djangocms-attributes-field PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on djangocms-attributes-field and may be impacted: - django-cms-qe =1.4.3, =0.6.2, =2.28.1, =2.39.2 Source cves: CVE-2024-11406 Source advisory:...

django-crunch (0.1.12), djangocms-dag-jetcode (>=1.0.0, <=1.3.1) potentially affected by CVE-2024-11406 via djangocms-attributes-field (2.1.0)

djangocms-attributes-field PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on djangocms-attributes-field and may be impacted: - django-crunch 0.1.12 - djangocms-dag-jetcode =1.0.0, =1.3.1 Source cves: CVE-2024-11406 Source advisory:...

richie (0.1.0) potentially affected by CVE-2024-11406 via djangocms-attributes-field (0.3.0)

djangocms-attributes-field PYPI version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on djangocms-attributes-field and may be impacted: - richie 0.1.0 Source cves: CVE-2024-11406 Source advisory: OSV:GHSA-VXCV-4XVF-PC22...

django-cms-qe (>=3.6.2, <=3.7.2), djangocms-aldryn-forms (>=7.0.4, <=7.9.0) +2 more potentially affected by CVE-2024-11406 via djangocms-attributes-field (3.0.0)

djangocms-attributes-field PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on djangocms-attributes-field and may be impacted: - django-cms-qe =3.6.2, =7.0.4, =1.0.0, =2.0.0, =3.0.1 Source cves: CVE-2024-11406 Source advisory:...

taccsite-cms (3.6.0a0) potentially affected by CVE-2024-11406 via djangocms-attributes-field (2.0.0)

djangocms-attributes-field PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on djangocms-attributes-field and may be impacted: - taccsite-cms 3.6.0a0 Source cves: CVE-2024-11406 Source advisory: OSV:GHSA-VXCV-4XVF-PC22...

GHSA-VXCV-4XVF-PC22 django CMS Attributes Field Cross-site Scripting

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS.This issue affects django CMS Attributes Fields: before 4.0...

richie (>=1.0.0b0, <=1.0.0b3) potentially affected by CVE-2024-11406 via djangocms-attributes-field (1.0.0)

djangocms-attributes-field PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on djangocms-attributes-field and may be impacted: - richie =1.0.0b0, =1.0.0b3 Source cves: CVE-2024-11406 Source advisory: OSV:GHSA-VXCV-4XVF-PC22...