553 matches found
WordPress Plugin Simple Membership Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
PT-2024-19618 · WordPress · Site Reviews
Name of the Vulnerable Software and Affected Versions: Site Reviews plugin for WordPress versions up to, and including, 6.11.4 Description: The issue is related to Stored Cross-Site Scripting via the user display name due to insufficient input sanitization and output escaping. This allows...
PT-2024-18473 · WordPress · Simple Membership
Name of the Vulnerable Software and Affected Versions: Simple Membership plugin for WordPress versions up to, and including, 4.4.2 Description: The issue is related to Stored Cross-Site Scripting via the Display Name parameter due to insufficient input sanitization and output escaping. This allow...
Site Reviews < 6.11.7 - Authenticated(Subscriber+) Stored Cross-Site Scripting via display name
Description The Site Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user display name in all versions up to, and including, 6.11.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber...
SUSE-SU-2024:0800-1 Security update for go1.21
This update for go1.21 fixes the following issues: - Upgrade go to version 1.21.8 - CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect bsc1221000 - CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm bsc122100...
CVE-2024-1720
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping...
PT-2024-18250 · WordPress · User Registration – Custom Registration Form
Name of the Vulnerable Software and Affected Versions: User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin versions up to, and including, 3.1.4 Description: The issue is related to Stored Cross-Site Scripting via the Display Name parameter due to insufficie...
AZL-79048 CVE-2024-24784 affecting package golang 1.25.7-1
The ParseAddressList function incorrectly handles comments text within parentheses within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers...
UBUNTU-CVE-2024-24784
The ParseAddressList function incorrectly handles comments text within parentheses within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers...
Improper Neutralization
Overview std/net/mail is a Go standard library package std/net/mail Affected versions of this package are vulnerable to Improper Neutralization. Go Vulnerability Report: The ParseAddressList function incorrectly handles comments text within parentheses within display names. Since this is a...
Google Go Security Vulnerability
Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google, Inc. A security vulnerability exists in Google Go that stems from the ParseAddressList function incorrectly handling comments in display names...
go -- multiple vulnerabilities
The Go project reports reports: crypto/x509: Verify panics on certificates with an unknown public key algorithm Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. net/http: memory exhaustion in...
CVE-2024-26542
Cross Site Scripting vulnerability in Bonitasoft, S.A v.7.14. and fixed in v.9.0.2, 8.0.3, 7.15.7, 7.14.8 allows attackers to execute arbitrary code via a crafted payload to the Groups Display name field...
Cross site scripting
Cross Site Scripting vulnerability in Bonitasoft, S.A v.7.14. and fixed in v.9.0.2, 8.0.3, 7.15.7, 7.14.8 allows attackers to execute arbitrary code via a crafted payload to the Groups Display name field...
Bonitasoft Cross-Site Scripting Vulnerability
Bonitasoft is an open source BPM software from Bonitasoft. A cross-site scripting vulnerability exists in Bonitasoft version v.7.14, which originates from a vulnerability that allows an attacker to execute arbitrary scripts via the Groups Display name field using a crafted payload...
CVE-2024-26542
Cross Site Scripting vulnerability in Bonitasoft, S.A v.7.14. and fixed in v.9.0.2, 8.0.3, 7.15.7, 7.14.8 allows attackers to execute arbitrary code via a crafted payload to the Groups Display name field...
PT-2024-21418 · Bonitasoft · Bonitasoft
Name of the Vulnerable Software and Affected Versions: Bonitasoft, S.A versions prior to 7.14.8 Bonitasoft, S.A versions prior to 7.15.7 Bonitasoft, S.A versions prior to 8.0.3 Bonitasoft, S.A versions prior to 9.0.2 Description: The issue allows attackers to execute arbitrary code via a crafted...
CVE-2024-0256
The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Profile Display Name and Social Settings in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-0256
The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Profile Display Name and Social Settings in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
