GHSA-6JJ6-GM7P-FCVV Remote Code Execution (RCE) vulnerability in geoserver

Summary Multiple OGC request parameters allow Remote Code Execution RCE by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. Details The GeoTools library API that GeoServer calls evaluates...

CVE-2024-36987

The CVE-2024-36987 vulnerability affects Splunk Enterprise versions prior to 9.2.2, 9.1.5, and 9.0.10, and Splunk Cloud Platform versions before 9.1.2312.200. An authenticated, low-privileged user who lacks admin/power roles can upload a file with an arbitrary extension via the indexing/preview R...

WordPress Extensions for Elementor plugin <= 2.0.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via url Parameter vulnerability discovered by Francesco Carlucci in WordPress Plugin Extensions for Elementor versions = 2.0.30...

WordPress Extensions for Elementor Plugin <= 2.0.30 is vulnerable to Cross Site Scripting (XSS)

Software Extensions for Elementor Type Plugin Vulnerable versions = 2.0.30 Fixed in 2.0.31 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5666 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 66cb64dd9468 Credits Francesco...

PHPOK Security Vulnerability

PHPOK is an enterprise website builder system that supports extensions. A security vulnerability exists in PHPOK version 6.4.003, which originates from the presence of a cross-site scripting XSS vulnerability...

GeoServer Security Vulnerabilities

GeoServer is GeoServer open source an open source software server written in Java. It allows users to share and edit geospatial data. A security vulnerability exists in GeoServer that stems from the fact that if GeoServer is deployed in a Windows operating system using the Apache Tomcat web...

CVE-2024-5666

The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the EE Button widget in all versions up to, and including, 2.0.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-5666

The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the EE Button widget in all versions up to, and including, 2.0.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-5666: Improper Neutralization of Input During Web Page Generation

The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the EE Button widget in all versions up to, and including, 2.0.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress plugin Extensions for Elementor security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security...

Malicious code in Stl.Plugins.Extensions.Net (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Sоlnet.Extensioոs (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in MaterialDesignExtensions.Net (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2803 Malicious code in operaextensions.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b9207a219bcb0da9f09f2b9c49edc832107607c624e5d9b3daa16b4c7fdf3d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mypy-extensions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 10ccf73f6507139e279e97b3fd9abef0395cd75b2f90dd18dde8e6f90753de4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @mqttapplicationsamples/mqttjsclientextensions (npm)

--- -= Per source details. Do not edit below this line.=-...

Arbitrary Code Execution

typo3/cms is vulnerable to arbitrary file upload. The vulnerability is due to a missing file extensions in $GLOBALS'TYPO3CONFVARS''BE''fileDenyPattern', allowing backend users to upload executable files such as .phar, .shtml, .pl, or .cgi in certain web server setups...

CVE-2023-50029

PHP Injection vulnerability in the module "M4 PDF Extensions" m4pdf up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the M4PDF::saveTemplate method...

CVE-2023-50029

PHP Injection vulnerability in the module "M4 PDF Extensions" m4pdf up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the M4PDF::saveTemplate method...

PT-2024-13851 · Prestashop · Prestashop M4 Pdf Extensions Module

Name of the Vulnerable Software and Affected Versions: PrestaShop M4 PDF Extensions module versions up to 3.3.2 Description: The issue allows attackers to run arbitrary code via the M4PDF::saveTemplate method, potentially leading to code injection attacks. This could enable malicious activities,...