PT-2024-25017 · Phlex · Phlex

Name of the Vulnerable Software and Affected Versions: Phlex versions prior to the patched versions available on RubyGems Description: The issue is a potential cross-site scripting XSS vulnerability that can be exploited via maliciously crafted user data. This occurs because the escapes were...

PT-2024-40748 · Git +1 · Pcapplusplus

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 2 crash has been reported. The crash involves the pcpp::BgpLayer::getHeaderLen, pcpp::Packet::shortenLayer, and...

Testimonial Widget Attributes Component XSS

The vulnerability of the Testimonial Widget Attributes component in the Jeg Elementor Kit plugin of the WordPress content management system is related to the lack of protective measures for website structures. Exploiting this vulnerability could allow a malicious actor to perform cross-site...

Phlex security vulnerability

phlex is a framework for building object-oriented views in Ruby. A security vulnerability exists in Phlex versions prior to 1.10.2, which stems from maliciously generated HTML attribute names and values in Phlex that could lead to cross-site scripting...

CVE-2023-46270

MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items...

CVE-2023-46270: Incorrect Default Permissions

MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items...

CVE-2023-46270

MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items...

PT-2024-13345 · Macpaw · The Unarchiver

Name of the Vulnerable Software and Affected Versions: MacPaw The Unarchiver versions prior to 4.3.6 Description: The issue is related to missing quarantine attributes for extracted items. This could potentially lead to security risks as extracted items may not be properly flagged for inspection ...

CVE-2023-46270

MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items...

PrestaShop SQL injection vulnerability

PrestaShop is an open source e-commerce solution from the American company PrestaShop. The solution provides multiple payment methods, short message alerts and product image zoom and other features. A SQL injection vulnerability exists in PrestaShop preorderandnotication 3.1.0 and earlier version...

CVE-2023-46270

MacPaw The Unarchiver versions prior to 4.3.6 are susceptible to a vulnerability involving missing quarantine attributes (or isolation attributes) for extracted items. This flaw stems from incorrect default permissions , potentially allowing extracted files to bypass standard security inspection ...

RHEL 9 : OpenShift Container Platform 4.13.8 (RHSA-2023:4459)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:4459 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

RHEL 9 : OpenShift Container Platform 4.13.3 (RHSA-2023:3540)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3540 advisory. Red Hat build of MicroShift is Red Hat's light-weight Kubernetes orchestration solution designed for edge device deployments and is built fr...

CVE-2024-3309 Qi Addons For Elementor <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown widget

The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget's attributes in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-3890 Happy Addons for Elementor <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly Widget

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Calendly widget in all versions up to, and including, 3.10.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-2159

The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

CVE-2024-3075

The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-3048

The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators...

CVE-2024-3188: Improper Neutralization of Input During Web Page Generation

The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored...

CVE-2024-3075: Improper Neutralization of Input During Web Page Generation

The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...