CVE-2024-4360 Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag

The Element Pack Elementor Addons Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 5.7.6 due to insufficient input sanitization and output escapi...

CVE-2024-4360

CVE-2024-4360 affects Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) for WordPress. Root cause: insufficient input sanitization and output escaping on user-supplied attributes like title_tag, enabling Stored XSS via widgets. Affected versio...

WordPress Element Pack Elementor Addons plugin <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via titletag vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Element Pack Elementor Addons versions = 5.7.6...

WordPress Element Pack Elementor Addons plugin <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read vulnerability

Authenticated Contributor+ Arbitrary File Read vulnerability discovered by Webbernaut in WordPress Plugin Element Pack Elementor Addons versions = 5.7.2...

WordPress Element Pack Elementor Addons Plugin <= 5.7.6 is vulnerable to Cross Site Scripting (XSS)

Software Element Pack Elementor Addons Type Plugin Vulnerable versions = 5.7.6 Fixed in 5.7.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4360 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b1a260751a26 Credits Ngô Thiên ...

PT-2024-30603 · WordPress · Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Element Pack Elementor Addons plugin for WordPress versions up to, and including, 5.7.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's widgets due to insufficient input sanitization and output escaping o...

PT-2024-30602 · WordPress · Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Element Pack Elementor Addons plugin for WordPress versions up to, and including, 5.7.2 Description: The issue allows authenticated attackers with contributor-level access and above to read the contents of arbitrary files on the server,...

WordPress Element Pack Elementor Addons Plugin <= 5.7.2 is vulnerable to Arbitrary File Download

Software Element Pack Elementor Addons Type Plugin Vulnerable versions = 5.7.2 Fixed in 5.7.3 OWASP Top 10 A3: Sensitive Data Exposure Classification Arbitrary File Download CVE CVE-2024-4359 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID da58af1324ba Credits Webbernaut...

WordPress LA-Studio Element Kit for Elementor Plugin <= 1.3.9.2 is vulnerable to Cross Site Scripting (XSS)

Software LA-Studio Element Kit for Elementor Type Plugin Vulnerable versions = 1.3.9.2 Fixed in 1.3.9.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43210 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2d710467debc Credits Khalid Yusuf...

kernel: irqchip/gic-v3-its: Fix potential VPE leak on error

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Fix potential VPE leak on error In itsvpeirqdomainalloc, when itsvpeinit returns an error, there is an off-by-one in the number of VPEs to be freed. Fix it by simply passing the number of VPEs allocated, which...

kernel: irqchip/gic-v3-its: Fix potential VPE leak on error

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Fix potential VPE leak on error In itsvpeirqdomainalloc, when itsvpeinit returns an error, there is an off-by-one in the number of VPEs to be freed. Fix it by simply passing the number of VPEs allocated, which...

OPENSUSE-SU-2024:14242-1 element-web-1.11.73-1.1 on GA media

These are all security issues fixed in the element-web-1.11.73-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2024-25058 · Qualcomm · Snapdragon +232

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a Transient Denial of Service DOS that occurs while parsing multiple MBSSID IEs from a beacon. This happens when the tag length ...

PT-2024-25057 · Qualcomm · Snapdragon +232

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a Transient Denial of Service DOS that occurs when parsing the MBSSID IE from beacons, specifically when the MBSSID IE length is...

PT-2024-25069 · Qualcomm · Snapdragon +169

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue occurs when parsing the ML IE in a beacon, where the length field inside the common info of ML IE is greater than the ML IE length, resulting ...

PT-2024-25061 · Qualcomm · Snapdragon +181

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a Transient Denial of Service DOS that occurs while parsing SCAN RNR IE. This happens when the size of the last parameter of IE ...

PT-2024-25059 · Qualcomm · Snapdragon +159

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue occurs when a driver accesses the ML IE memory and the offset value is incremented beyond the ML IE length, resulting in a transient Denial of...

PT-2024-25056 · Qualcomm · Snapdragon +232

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a Transient Denial of Service DOS that occurs while parsing fragments of the Multiple BSSID Information Element MBSSID IE from a...

Microsoft Reactor Workshops reactorworkshops Uncontrolled Search Path Element Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Reactor Workshops. Authentication is not required to exploit this vulnerability. The specific flaw exists within the installation of Reactor Workshops. When installed from the official...

PT-2024-19832 · Qualcomm · 205 Mobile Platform Firmware +225

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves a transient Denial of Service DOS that occurs while decoding an attach reject message received by a UE User Equipment, specifically...