CVE-2024-7864

The CVE concerns the WordPress Favicon Generator plugin (versions prior to 2.1). A lack of CSRF protection and insufficient path validation in the output_sub_admin_page_0() function allows an attacker to induce logged-in admins to delete arbitrary files on the server. Impact is high for integrity...

CVE-2024-7863

The Favicon Generator (CLOSED) WordPress plugin, in versions prior to 2.1 , is vulnerable to arbitrary file upload via Cross-Site Request Forgery (CSRF) . The root cause is a lack of file validation during uploads and missing CSRF checks. This flaw could allow an attacker to manipulate a logged-i...

CVE-2024-7864 Favicon Generator < 2.1 - Arbitrary File Deletion via CSRF

The Favicon Generator CLOSED WordPress plugin before 2.1 does not have CSRF and path validation in the outputsubadminpage0 function, allowing attackers to make logged in admins delete arbitrary files on the server...

CVE-2024-7863 Favicon Generator < 2.1 - Arbitrary File Upload via CSRF

The Favicon Generator CLOSED WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server...

CVE-2024-7864 Favicon Generator < 2.1 - Arbitrary File Deletion via CSRF

The Favicon Generator CLOSED WordPress plugin before 2.1 does not have CSRF and path validation in the outputsubadminpage0 function, allowing attackers to make logged in admins delete arbitrary files on the server...

WordPress PDF Thumbnail Generator Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)

Software PDF Thumbnail Generator Type Plugin Vulnerable versions = 1.3 Fixed in 1.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8737 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8724205bb063 Credits vgo0 Required...

CVE-2024-7864: Cross-Site Request Forgery (CSRF)

The Favicon Generator CLOSED WordPress plugin before 2.1 does not have CSRF and path validation in the outputsubadminpage0 function, allowing attackers to make logged in admins delete arbitrary files on the server...

CVE-2024-7863: Cross-Site Request Forgery (CSRF)

The Favicon Generator CLOSED WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server...

PT-2024-39214 · WordPress · Pdf Thumbnail Generator

Name of the Vulnerable Software and Affected Versions: PDF Thumbnail Generator plugin for WordPress versions up to, and including, 1.3 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This allows...

WordPress Plugin PDF Thumbnail Generator Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plug-in. A cross-site scripting...

WordPress Plugin Favicon Generator has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security...

CVE-2024-8737: Improper Neutralization of Input During Web Page Generation

The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

WordPress Plugin Favicon Generator has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security...

PT-2024-38640 · WordPress · The Favicon Generator

Name of the Vulnerable Software and Affected Versions: The Favicon Generator CLOSED WordPress plugin versions prior to 2.1 Description: The issue concerns a lack of file validation for uploads and missing CSRF checks. This could allow attackers to make logged-in admins upload arbitrary files, suc...

PT-2024-38641 · WordPress · The Favicon Generator

Name of the Vulnerable Software and Affected Versions: The Favicon Generator CLOSED WordPress plugin versions prior to 2.1 Description: The issue concerns a lack of CSRF and path validation in the output sub admin page 0 function. This allows attackers to make logged-in admins delete arbitrary...

kernel: x86/coco: Require seeding RNG with RDRAND on CoCo systems

CVE-2024-35875 addresses a security concern in the Linux kernel's handling of confidential computing CoCo environments. In these setups, the virtual machine VM host is untrusted and may attempt to compromise guest VMs. A critical component for maintaining security in such environments is a reliab...

NewStart CGSL MAIN 6.02 : libssh Multiple Vulnerabilities (NS-SA-2024-0052)

The remote NewStart CGSL host, running version MAIN 6.02, has libssh packages installed that are affected by multiple vulnerabilities: - The RANDbytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator PRNG,...

CVE-2024-44085

ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expression IIFE for a macro. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446 and CVE-2023-50883...

PDF Generator Web Application 1.0 Insecure Settings

==================================================================================================================================== | Title : PDF Generator Web Application v1.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox...

CVE-2024-8560

A vulnerability, which was classified as critical, was found in SourceCodester Simple Invoice Generator System 1.0. Affected is an unknown function of the file /saveinvoice.php. The manipulation of the argument...