Rails HTML Sanitizers 跨站脚本漏洞

Rails HTML Sanitizers is an HTML cleanup tool from the US Rails team for use in Rails applications. A cross-site scripting vulnerability exists in Rails HTML Sanitizers version 1.6.0, which stems from a cross-site scripting vulnerability under certain configurations that could easily lead to...

Rails HTML Sanitizers 跨站脚本漏洞

Rails HTML Sanitizers is an HTML cleanup tool from the US Rails team for use in Rails applications. A cross-site scripting vulnerability exists in Rails HTML Sanitizers version 1.6.0, which stems from a cross-site scripting vulnerability under certain configurations that could easily lead to...

WordPress Calculated Fields Form Plugin <= 5.2.45 is vulnerable to Content Injection

Software Calculated Fields Form Type Plugin Vulnerable versions = 5.2.45 Fixed in 5.2.46 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-9940 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID bb237d0845c6 Credits Max Boll b0lli Required privile...

WordPress WooCommerce Plugin <= 9.0.2 is vulnerable to Content Injection

Software WooCommerce Type Plugin Vulnerable versions = 9.0.2 Fixed in 9.1.0 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-9944 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID b045fb73bcc4 Credits drop Required privilege Unauthenticated Published ...

WordPress AADMY Plugin <= 2.0.1 is vulnerable to Content Injection

Software AADMY Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.0.2 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-9837 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID e1df1286c7c4 Credits Francesco Carlucci Required privilege...

WordPress WP Popup Builder Plugin <= 1.3.5 is vulnerable to Content Injection

Software WP Popup Builder Type Plugin Vulnerable versions = 1.3.5 Fixed in 1.3.6 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-9061 Patch priority Medium CVSS severity Medium 7.9 Developer Claim ownership PSID f6bee0964d75 Credits Francesco Carlucci Required privilege...

CVE-2024-46980 Tuleap vulnerable to XSS in the HTML mail content of the cross reference field

Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.37, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6, a site administrator could create an artifact link type with a forward label allowing them ...

WordPress Shortcodes AnyWhere Plugin <= 1.0.1 is vulnerable to Content Injection

Software Shortcodes AnyWhere Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-9581 Patch priority Medium CVSS severity Medium 7.3 Developer Claim ownership PSID 9c5d59c3c6ea Credits Francesco Carlucci Required privilege...

FreeBSD : Gitlab -- vulnerabilities (4b7ed61f-7bbf-11ef-9369-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 4b7ed61f-7bbf-11ef-9369-2cf05da270f3 advisory. Gitlab reports: Maintainer can leak Dependency Proxy password by changing Dependency Proxy URL...

CVE-2024-45808

A flaw was found in envoy. Affected versions of envoy may allow malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the REQUESTEDSERVERNAME field for access loggers. Mitigation Mitigation for this issue is either not availab...

CVE-2024-45808

Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the REQUESTEDSERVERNAME field for access logger...

CVE-2024-45808

CVE-2024-45808 affects the Envoy proxy and stems from insufficient validation of the REQUESTED_SERVER_NAME in access loggers, enabling potential log content manipulation. Affected versions are 1.31.2, 1.30.6, 1.29.9, and 1.28.7; upgrade to the fixed releases to remediate. The connected sources co...

CVE-2024-46976 Circumvention of cross site scripting Protection in @backstage/plugin-techdocs-backend

Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attack...

CVE-2024-7654

An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was activated. Unauthorized access to the discovery service's UDP port allowed content injection into parts of the OEM web interface making it possible for other...

CVE-2024-7654

An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was activated. Unauthorized access to the discovery service's UDP port allowed content injection into parts of the OEM web interface making it possible for other...

CVE-2024-7654 Unauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery service

An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was activated. Unauthorized access to the discovery service's UDP port allowed content injection into parts of the OEM web interface making it possible for other...

CVE-2024-7654

The CVE affects Progress OpenEdge Management with OEE/OEM auto-discovery, where the ActiveMQ Discovery service was reachable by default. Unauthorized access to the discovery service’s UDP port allowed content injection into parts of the OEM web interface, enabling potential user deception. Public...

CVE-2024-7654 Unauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery service

An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was activated. Unauthorized access to the discovery service's UDP port allowed content injection into parts of the OEM web interface making it possible for other...

WordPress REST API Content Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress REST API Content Injection', 'Description' = %q This module exploits a content injection vulnerability in WordPress versions 4.7 and...

WordPress RegistrationMagic Plugin <= 6.0.1.0 is vulnerable to Content Injection

Software RegistrationMagic Type Plugin Vulnerable versions = 6.0.1.0 Fixed in 6.0.1.1 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-43317 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 40c223a7e4da Credits SOPROBRO Required privilege...