WordPress Plugin wp-cirrus Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2023-24720 · WordPress · Wp-Cirrus

Name of the Vulnerable Software and Affected Versions: WP-Cirrus plugin versions 0.6.11 and earlier Description: A Cross-Site Request Forgery CSRF issue exists, which can be exploited by an attacker to perform unauthorized actions on the affected system. Recommendations: For WP-Cirrus plugin...

kernel: Linux kernel: ALSA HDA denial of service via array overflow

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA High Definition Audio HDA component. A local user could exploit this vulnerability by providing specially crafted 9.1 surround channel names, leading to an array overflow in the getlineoutpfx function. This can cause a...

Oracle Linux 7 : qemu (ELSA-2018-4289)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4289 advisory. - net: ignore packet size greater than INTMAX Jason Wang Orabug: 28763782 CVE-2018-17963 - pcnet: fix possible buffer overflow Jason Wang Orabug:...

CVE-2023-36692

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Christian Kramer & Hendrik Thole WP-Cirrus plugin = 0.6.11 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Christian Kramer & Hendrik Thole WP-Cirrus plugin = 0.6.11 versions...

CVE-2023-36692 WordPress WP-Cirrus Plugin <= 0.6.11 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Christian Kramer & Hendrik Thole WP-Cirrus plugin = 0.6.11 versions...

CVE-2023-36692

WP-Cirrus plugin for WordPress is affected by a stored XSS vulnerability (CVE-2023-36692) that requires authenticated admin+ privileges. The issue affects versions up to and including 0.6.11. The impact is described as cross-site scripting with potential for admin-level abuse, and remediation is ...

WordPress plugin wp-cirrus cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2023-25685 · WordPress · Wp-Cirrus

Name of the Vulnerable Software and Affected Versions: WP-Cirrus plugin versions 0.6.11 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For WP-Cirrus plugin versions 0.6.11 and...

WordPress WP-Cirrus Plugin <= 0.6.11 is vulnerable to Cross Site Scripting (XSS)

Software WP-Cirrus Type Plugin Vulnerable versions = 0.6.11 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-36692 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 901c83317f18 Credits LEE SE HYOUNG hackintoanetwork...

WordPress WP-Cirrus Plugin <= 0.6.11 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP-Cirrus Type Plugin Vulnerable versions = 0.6.11 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-34181 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 70302c5747d1 Credits LEE SE HYOUNG...

Malicious code in cirrus-matchmaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 086ee48f51dc34391e9a296e791f83f5fad1d81e111f0ef00e0691d1f7b313ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-177 Malicious code in cirrus-matchmaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 086ee48f51dc34391e9a296e791f83f5fad1d81e111f0ef00e0691d1f7b313ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview cirrus-matchmaker is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

K63519101: Multiple QEMU vulnerabilities

Security Advisory Description CVE-2014-8106 Heap-based buffer overflow in the Cirrus VGA emulator hw/display/cirrusvga.c in QEMU before 2.2.0 allows local guest users to execute arbitrary code via vectors related to blit regions. NOTE: this vulnerability exists because an incomplete fix for...

SUSE CVE-2008-4539

Heap-based buffer overflow in the Cirrus VGA implementation in 1 KVM before kvm-82 and 2 QEMU on Debian GNU/Linux and Ubuntu might allow local users to gain privileges by using the VNC console for a connection, aka the LGD-54XX "bitblt" heap overflow. NOTE: this issue exists because of an incorre...

SUSE CVE-2014-8106

Heap-based buffer overflow in the Cirrus VGA emulator hw/display/cirrusvga.c in QEMU before 2.2.0 allows local guest users to execute arbitrary code via vectors related to blit regions. NOTE: this vulnerability exists because an incomplete fix for CVE-2007-1320...

SUSE CVE-2016-9603

A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this fla...

SUSE CVE-2016-9921

Quick emulator Qemu built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process instance on the host,...