URL Redirection to Untrusted Site ('Open Redirect')

Overview IdentityServer4 is an OpenID Connect and OAuth 2.0 Framework for ASP.NET Core Affected versions of this package are vulnerable to URL Redirection to Untrusted Site 'Open Redirect' through the commonly used GetAuthorizationContextAsync and IsValidReturnUrl methods which return non-null...

CVE-2024-41818

A regular expression denial of service ReDoS flaw was found in fast-xml-parser in the currency.js script. By sending a specially crafted regex input, a remote attacker could cause a denial of service condition...

WordPress Formidable Forms Plugin <= 6.11.1 is vulnerable to Cross Site Scripting (XSS)

Software Formidable Forms Type Plugin Vulnerable versions = 6.11.1 Fixed in 6.11.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6725 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID b87ac759b2ea Credits zer0gh0st Required...

WordPress Zephyr Project Manager Plugin < 3.3.99 is vulnerable to Cross Site Scripting (XSS)

Software Zephyr Project Manager Type Plugin Vulnerable versions 3.3.99 Fixed in 3.3.99 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6536 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7446412b149f Credits Adrian Peña...

WordPress SportsPress – Sports Club & League Manager Plugin < 2.7.22 is vulnerable to Cross Site Scripting (XSS)

Software SportsPress – Sports Club & League Manager Type Plugin Vulnerable versions 2.7.22 Fixed in 2.7.22 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3986 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5c451eff9368 Credi...

PT-2024-41004 · Unknown · Containerized-Data-Importer

Name of the Vulnerable Software and Affected Versions: containerized-data-importer versions prior to 1.59.0 Description: The issue is fixed by updating to version 1.59.0 of the containerized-data-importer. Release notes for versions 1.59.0 and 1.58.1 are available, providing more information abou...

UBUNTU-CVE-2024-41817

ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The AppImage version ImageMagick might use an empty path when setting MAGICKCONFIGUREPATH and LDLIBRARYPATH environment variables while executing, which might lead to arbitrary code execution b...

CVE-2024-41817 Arbitrary Code Execution in `AppImage` version `ImageMagick`

ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The AppImage version ImageMagick might use an empty path when setting MAGICKCONFIGUREPATH and LDLIBRARYPATH environment variables while executing, which might lead to arbitrary code execution b...

CVE-2024-41810

CVE-2024-41810 affects Twisted, where the HTML in the redirect body produced by the function twisted.web.util.redirectTo can be injected if an attacker controls the redirect URL, potentially enabling Reflected XSS. The vulnerability is fixed in Twisted 24.7.0rc1. Public advisories across distribu...

DEBIAN-CVE-2024-41671

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1...

CVE-2024-7193

Summary of CVE-2024-7193 (Mp3tag): Affected software is Mp3tag up to version 3.26d, with the vulnerability located in the DLL Handler’s tak_deco_lib.dll. The issue is an uncontrolled search path resulting from code in tak_deco_lib.dll, enabling local-host exploitation. Public exploit information ...

WordPress WooCommerce Product Table Lite Plugin <= 3.5.1 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Product Table Lite Type Plugin Vulnerable versions = 3.5.1 Fixed in 3.8.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6458 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID b99493f3472e Credits Luc...

WordPress Happy Addons for Elementor Plugin <= 3.11.2 is vulnerable to Cross Site Scripting (XSS)

Software Happy Addons for Elementor Type Plugin Vulnerable versions = 3.11.2 Fixed in 3.11.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6627 Patch priority Low CVSS severity Low 6.5 Developer Leevio PSID 0dee5f2221b3 Credits Webbernaut Required...

WordPress Campaign Monitor for WordPress Plugin <= 2.8.15 is vulnerable to Sensitive Data Exposure

Software Campaign Monitor for WordPress Type Plugin Vulnerable versions = 2.8.15 Fixed in 2.8.16 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-6569 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 63abfd042be5 Credits...

WordPress Ultimate Auction Plugin <= 4.2.67 is vulnerable to Broken Access Control

Software Ultimate Auction Type Plugin Vulnerable versions = 4.2.67 Fixed in 4.2.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6591 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID 97fe9efdff7a Credits Lucio Sá Required...

PT-2024-29715 · Cervantes · Cervantes

Name of the Vulnerable Software and Affected Versions: Cervantes versions through 0.5-alpha Description: The issue allows stored XSS. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. Recommendation...

PT-2024-27056 · Fabedge · Fabedge

Name of the Vulnerable Software and Affected Versions: fabedge version 0.8.1 Description: The issue concerns insecure permissions in fabedge, allowing attackers to access sensitive data and escalate privileges by obtaining the service account's token. Recommendations: For fabedge version 0.8.1,...

WordPress All-in-One Video Gallery Plugin <= 3.7.1 is vulnerable to Cross Site Scripting (XSS)

Software All-in-One Video Gallery Type Plugin Vulnerable versions = 3.7.1 Fixed in 3.8.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6629 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 570fc0403d8c Credits Webbernaut...

WordPress Contest Gallery Plugin <= 23.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Contest Gallery Type Plugin Vulnerable versions = 23.1.2 Fixed in 23.1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-39631 Patch priority Medium CVSS severity Medium 7.1 Developer Wasiliy Strecker PSID e98eae916e49 Credits CatFather Required privilege...

WordPress PowerPack Pro for Elementor Plugin <= 2.10.14 is vulnerable to Privilege Escalation

Software PowerPack Pro for Elementor Type Plugin Vulnerable versions = 2.10.14 Fixed in 2.10.15 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-39634 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID...