PT-2024-21425 · WordPress · Font Farsi

Name of the Vulnerable Software and Affected Versions: Font Farsi plugin for WordPress versions up to, and including, 1.6.6 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated...

CVE-2024-2657: Improper Neutralization of Alternate XSS Syntax

The Font Farsi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

Font Farsi <= 1.6.6 - Administrator+ Stored Cross-Site Scripting

Description The Font Farsi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

Ubuntu 20.04 LTS : Firefox regressions (USN-6779-2)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6779-2 advisory. USN-6779-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. Tenable has extracted the preceding...

harfbuzz:hb-draw-fuzzer: Crash in OT::VarComponent::get_path_at

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6610112583106560 Project: harfbuzz Fuzzing Engine: afl Fuzz Target: hb-draw-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x5160ffe90780 Crash State:...

Mozilla: Use-after-free could occur when printing to PDF

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: When saving a page to PDF, certain font styles could have led to a potential use-after-free crash...

WordPress Automatic Translator with Google Translate plugin <= 1.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Font vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via Custom Font vulnerability discovered by emad in WordPress Plugin Automatic Translator with Auto Translate versions = 1.5.4...

python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument

A flaw was found in Pillow. A denial of service issue uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for TrueType in ImageFont when text length in an ImageDraw instance operates on a long text argument...

webkitgtk: Processing a file may lead to a denial of service or potentially disclose memory contents

A use-after-free vulnerability was found in the SVG implementation within WebKitGTK. This flaw allows remote attackers to exploit the removal of an SVGFontFaceElement object, which occurs through specific vectors that trigger the deletion of the object during rendering...

USN-6782-1 thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing,...

USN-6782-1: Thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing,...

WordPress WP Font Awesome Share Icons plugin <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Lucio Sá in WordPress Plugin WP Font Awesome Share Icons versions = 1.1.1...

WordPress WP Font Awesome Share Icons Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Font Awesome Share Icons Type Plugin Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3198 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8224cc2ac039 Credits Lucio Sá...

WordPress plugin WP Font Awesome Share Icons 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability...

PT-2024-24332 · WordPress · Wp Font Awesome Share Icons

Name of the Vulnerable Software and Affected Versions: WP Font Awesome Share Icons plugin for WordPress versions up to, and including, 1.1.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'wpfai social' shortcode due to insufficient input sanitization and output...

Adobe InDesign Memory Walking Privilege Escalation

The vulnerability of Adobe InDesign’s computer layout automation tool is related to memory-walking attacks. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information and bypass security mechanisms like ASLR...

CVE-2024-0632: Improper Neutralization of Input During Web Page Generation

The Automatic Translator with Google Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom font setting in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-3198: Improper Neutralization of Input During Web Page Generation

The WP Font Awesome Share Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpfaisocial' shortcode in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : Thunderbird vulnerabilities (USN-6782-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6782-1 advisory. Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsin...

Researchers Uncover Flaws in Python Package for AI Models and PDF.js Used by Firefox

A critical security flaw has been disclosed in the llamacpppython Python package that could be exploited by threat actors to achieve arbitrary code execution. Tracked as CVE-2024-34359 CVSS score: 9.7, the flaw has been codenamed Llama Drama by software supply chain security firm Checkmarx. "If...