Design/Logic Flaw

The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field...

CVE-2012-6716

The CVE-2012-6716 entry relates to the WordPress Events Manager plugin prior to 5.1.7, which has a cross-site scripting (XSS) vulnerability via JSON call links. Connected sources confirm the affected software and version (pre-5.1.7) and describe the payload as client-side script injection through...

CVE-2013-7480

The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas...

CVE-2013-7480

CVE-2013-7480 concerns the WordPress Events Manager plugin prior to version 5.3.6.1, where an XSS flaw exists via the booking form and admin areas. The Red Hat, CNVD, CVE records and WPVulnDB entries consistently describe the issue as a cross-site scripting vulnerability that can affect the plugi...

CVE-2013-7478

The CVE-2013-7478 entry concerns the WordPress events-manager plugin (versions prior to 5.5). It describes a stored/reflected XSS vulnerability in the EM_Ticket::get_post function, enabling client-side script execution. Affected product/component: events-manager WordPress plugin; root cause: XSS ...

CVE-2013-7478

The events-manager plugin before 5.5 for WordPress has XSS via EMTicket::getpost...

CVE-2013-7477

The CVE-2013-7477 entry concerns the WordPress Events Manager plugin, with an XSS flaw in the booking form present in versions prior to 5.5.2. Affected software: events-manager plugin for WordPress; vulnerable component: booking form input handling. Root cause per sources is an XSS vulnerability,...

PT-2019-7027 · WordPress · Events Manager

Name of the Vulnerable Software and Affected Versions: events-manager plugin versions prior to 5.5 Description: The issue concerns a cross-site scripting XSS flaw. It affects the events-manager plugin for WordPress, specifically via the EM Ticket::get post function. Recommendations: For versions...

PT-2019-7026 · WordPress · Events Manager

Name of the Vulnerable Software and Affected Versions: events-manager plugin versions prior to 5.5.2 Description: The issue concerns a cross-site scripting XSS flaw in the booking form of the events-manager plugin. This type of flaw allows attackers to inject malicious scripts into the website,...

PT-2019-7029 · WordPress · Events Manager

Name of the Vulnerable Software and Affected Versions: events-manager plugin versions prior to 5.3.6.1 Description: The issue affects the events-manager plugin for WordPress, allowing XSS attacks via the booking form and admin areas. Recommendations: For versions prior to 5.3.6.1, update to versi...

PT-2019-6824 · WordPress · Events Manager

Name of the Vulnerable Software and Affected Versions: events-manager plugin versions prior to 5.1.7 Description: The issue concerns a cross-site scripting XSS vulnerability via JSON call links. This type of vulnerability allows an attacker to inject malicious scripts into a website, potentially...

PT-2019-7028 · WordPress · Events Manager

Name of the Vulnerable Software and Affected Versions: events-manager plugin versions prior to 5.3.9 Description: The issue concerns a Cross-Site Scripting XSS flaw in the search form field of the events-manager plugin for WordPress. Recommendations: For versions prior to 5.3.9, update to version...

CVE-2019-15109

The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribepaged URL parameter...

CVE-2019-15109

The CVE-2019-15109 entry relates to WordPress plugin The Events Calendar (prior to version 4.8.2) and is caused by an XSS flaw in the tribe_paged URL parameter. Exploitation could enable client-side code execution. Affected software is the Events Calendar plugin for WordPress; vulnerable componen...

PT-2019-13989 · Modern Tribe · The Events Calendar

Name of the Vulnerable Software and Affected Versions: the-events-calendar plugin versions prior to 4.8.2 Description: The issue is related to a Cross-Site Scripting XSS flaw. The tribe paged URL parameter is vulnerable to XSS attacks. Recommendations: For versions prior to 4.8.2, update to versi...

Node.js: Http response is not ended although underlying socket is already destroyed

Summary: When node server receives http request and hooks to end, finish and error events are attached on response object to handle cases when response is closed/ended but underlying socket is abruptly terminated then none of those events is fired. This leads to state when response seems to be...

LibreOffice Input Validation Error Vulnerability (CNVD-2019-39681)

LibreOffice is an open source office software suite from The Document Foundation TDF. The product includes applications such as Writer text documents, Calc spreadsheets and Impress presentations. LibreOffice suffers from a security-mode bypass vulnerability that can be exploited by an attacker to...

Patches for 2 Severe LibreOffice Flaws Bypassed — Update to Patch Again

If you are using LibreOffice, you need to update it once again. LibreOffice has released the latest version 6.2.6/6.3.0 of its open-source office software to address three new vulnerabilities that could allow attackers to bypass patches for two previously addressed vulnerabilities. LibreOffice is...

CVE-2016-10894

xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to and thus control various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks by depressing the touchpad once and th...

CVE-2016-10894

xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to and thus control various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks by depressing the touchpad once and th...