2217 matches found
CVE-2024-32957 WordPress Page Builder: Live Composer plugin <= 1.5.38 - Broken Access Control vulnerability
Missing Authorization vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.38...
mdanter/ecc affected by timing vulnerability in cryptographic side-channels
phpecc, as used in all versions of mdanter/ecc, as well as paragonie/ecc before 2.0.1, has a branch-based timing leak in Point addition. This Composer package is also known as phpecc/phpecc on GitHub, previously known as the Matyas Danter ECC library. Paragon Initiative Enterprises hard-forked...
QR Code Composer < 2.0.4 - Subscriber+ Stored XSS
Description The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user...
Cryptographic side-channels in PHPECC
ECDSA Canonicalization PHPECC is vulnerable to malleable ECDSA signature attacks. Constant-Time Signer When generating a new ECDSA signature, the GMPMath adapter was used. This class wraps the GNU Multiple Precision arithmetic library GMP, which does not aim to provide constant-time implementatio...
WordPress Page Builder: Live Composer plugin <= 1.5.38 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin Page Builder: Live Composer versions = 1.5.38...
WordPress Page Builder: Live Composer Plugin <= 1.5.38 is vulnerable to Broken Access Control
Software Page Builder: Live Composer Type Plugin Vulnerable versions = 1.5.38 Fixed in 1.5.39 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32957 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 6edbbb14734c Credits savphill Requir...
OESA-2024-1479 apache-mime4j security update
Java stream based MIME message parser. Security Fixes: Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages. CVE-2024-21742...
WordPress tagDiv Composer plugin <= 4.8 - Authenticated Stored Cross-Site Scripting via Attachment Meta vulnerability
Authenticated Stored Cross-Site Scripting via Attachment Meta vulnerability discovered by István Márton in WordPress Plugin tagDiv Composer versions = 4.8...
WordPress tagDiv Composer plugin <= 4.8 - Authenticated Local File Inclusion via Shortcode vulnerability
Authenticated Local File Inclusion via Shortcode vulnerability discovered by István Márton in WordPress Plugin tagDiv Composer versions = 4.8...
CVE-2024-32560
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sharabindu QR Code Composer allows Stored XSS.This issue affects QR Code Composer: from n/a through 2.0.3...
CVE-2024-32560 WordPress QR Code Composer plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sharabindu QR Code Composer allows Stored XSS.This issue affects QR Code Composer: from n/a through 2.0.3...
CVE-2024-32560
CVE-2024-32560 is a Stored XSS in QR Code Composer (Sharabindu) for WordPress. Affected: QR Code Composer up to version 2.0.3. The issue stems from improper input handling in web page generation. A patch is available (patched in Wordfence entries); remediation is to upgrade to the patched version...
CVE-2024-32560 WordPress QR Code Composer plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sharabindu QR Code Composer allows Stored XSS.This issue affects QR Code Composer: from n/a through 2.0.3...
WordPress tagDiv Composer Plugin <= 4.8 is vulnerable to Cross Site Scripting (XSS)
Software tagDiv Composer Type Plugin Vulnerable versions = 4.8 Fixed in 4.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3814 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID aede7898e0d1 Credits István Márton Required...
WordPress tagDiv Composer Plugin <= 4.8 is vulnerable to Local File Inclusion
Software tagDiv Composer Type Plugin Vulnerable versions = 4.8 Fixed in 4.9 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-3813 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 5ffa96c3f191 Credits István Márton Required privilege Contributor...
WordPress Plugin QR Code Composer 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...
WordPress QR Code Composer plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin QR Code Composer versions = 2.0.3...
Page Builder: Live Composer < 1.5.36 - Cross-Site Request Forgery
Description The Page Builder: Live Composer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.35. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform...
WordPress QR Code Composer Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)
Software QR Code Composer Type Plugin Vulnerable versions = 2.0.3 Fixed in 2.0.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32560 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 2b079e25db67 Credits stealthcopter Required privileg...