GHSA-2QJP-FG8C-G878 vxe-table Cross-site Scripting vulnerability

A vulnerability, which was classified as problematic, has been found in xuliangzhan vxe-table up to 3.7.9. This issue affects the function export of the file packages/textarea/src/textarea.js of the component vxe-textarea. The manipulation of the argument inputValue leads to cross site scripting...

On the Zero-Day Market

New paper: "Zero Progress on Zero Days: How the Last Ten Years Created the Modern Spyware Market": Abstract: Spyware makes surveillance simple. The last ten years have seen a global market emerge for ready-made software that lets governments surveil their citizens and foreign adversaries alike an...

CSV Injection

Ghost is vulnerable to CSV Injection. The vulnerability is due to inadequate input sanitization during member CSV export, allowing malicious content to be injected into CSV files, and executed when opened by a spreadsheet application...

CVE-2023-1001

A vulnerability, which was classified as problematic, has been found in xuliangzhan vxe-table up to 3.7.9. This issue affects the function export of the file packages/textarea/src/textarea.js of the component vxe-textarea. The manipulation of the argument inputValue leads to cross site scripting...

CVE-2023-1001 xuliangzhan vxe-table vxe-textarea textarea.js export cross site scripting

A vulnerability, which was classified as problematic, has been found in xuliangzhan vxe-table up to 3.7.9. This issue affects the function export of the file packages/textarea/src/textarea.js of the component vxe-textarea. The manipulation of the argument inputValue leads to cross site scripting...

CVE-2023-1001

The CVE-2023-1001 entry concerns xuliangzhan vxe-table (up to 3.7.9) where the textarea.js export function inputValue is vulnerable to cross-site scripting. The vulnerability is exploitable remotely and is caused by improper handling of inputValue in the vxe-textarea component. Upgrade to version...

WordPress plugin RomethemeForm For Elementor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-31215 · WordPress · The 140+ Widgets

Name of the Vulnerable Software and Affected Versions: The 140+ Widgets | Best Addons For Elementor – FREE for WordPress versions up to, and including, 1.4.3.1 Description: The issue allows authenticated attackers with contributor-level permissions and above to inject a PHP Object via...

WordPress plugin 140+ Widgets Best Addons For Elementor–FREE 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2024-14928 · WordPress · Romethemeform For Elementor

Name of the Vulnerable Software and Affected Versions: RomethemeForm For Elementor plugin for WordPress versions up to, and including, 1.1.5 Description: The issue allows unauthorized access and modification of data due to a missing capability check on the export entries, rtformnewform, and...

GHSA-XGWH-CGV9-783V Ghost allows CSV Injection during member CSV export

Ghost before 5.82.0 allows CSV Injection during a member CSV export...

Ghost allows CSV Injection during member CSV export

Ghost before 5.82.0 allows CSV Injection during a member CSV export...

CVE-2024-4563

The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length...

CVE-2024-4563

The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length...

CVE-2024-4563 The Progress MOVEit Automation Configuration Export Function Uses a Cryptographic Method with Insufficient Bit Length

The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length...

CVE-2024-4563 The Progress MOVEit Automation Configuration Export Function Uses a Cryptographic Method with Insufficient Bit Length

The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length...

CVE-2024-34448

Ghost before 5.82.0 allows CSV Injection during a member CSV export...

CVE-2024-34448

Ghost before 5.82.0 allows CSV Injection during a member CSV export...

CVE-2024-34448

CVE-2024-34448 affects Ghost prior to 5.82.0. The vulnerability arises in the member CSV export feature, where insufficient input sanitization enables CSV injection in exported files. Documents consistently describe Ghost as vulnerable to CSV injection via the CSV export process. Impact is descri...

CVE-2024-34448

Ghost before 5.82.0 allows CSV Injection during a member CSV export...