PT-2022-15973

Name of the Vulnerable Software and Affected Versions jQuery Cookie version 1.4.1 Description The issue is related to prototype pollution, which can lead to DOM cross-site scripting XSS. This occurs due to parameter pollution in the affected software. Recommendations For jQuery Cookie version...

WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE

The plugin allows users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded directory of the plugin, resulting in arbitrary code execution. As a contributor or above, add the...

Hayageek Jquery Upload File Cross-Site Scripting Vulnerability

Hayageek Jquery Upload File is a jQuery-based file upload plugin from Hayageek's personal developer. Hayageek Jquery Upload File v4.0.11 contains a cross-site scripting vulnerability that could be exploited by attackers to execute arbitrary web script or HTML via a specially crafted file with a...

jquery-ui security update

1.10.4.custom-4.0.1 - Backport jQuery CVE-2020-11022 and CVE-2020-11023 fixes to bundled jQuery v1.10.2 Orabug: 33869588 1.10.4.custom-4 - removed %%defattr from specfile - removed Group from specfile - removed BuildRoot from specfiles Tue May 10 2016 Grant Gainey 1.10.4.custom-3 - jquery-ui: bui...

Oracle Linux 7 : jquery-ui (ELSA-2022-9177)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-9177 advisory. - Backport jQuery CVE-2020-11022 and CVE-2020-11023 fixes to bundled jQuery v1.10.2 Orabug: 33869588 Tenable has extracted the preceding description...

WordPress WordPress Dev Powers – Element Selector jQuery Powers Plugin plugin <= 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WordPress Dev Powers – Element Selector jQuery Powers Plugin plugin versions = 1.0.1. Solution No patched version available...

WordPress NoFollow jQuery Links plugin <= 1.4.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress NoFollow jQuery Links plugin versions = 1.4.0. Solution Update the WordPress NoFollow jQuery Links plugin to the latest available version at least 1.4.1...

WordPress WordPress Dev Powers – Element Selector jQuery Powers Plugin plugin <= 1.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WordPress Dev Powers – Element Selector jQuery Powers Plugin plugin versions = 1.0.1. Solution No patched version available...

WordPress NoFollow jQuery Links plugin <= 1.4.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress NoFollow jQuery Links plugin versions = 1.4.0. Solution Update the WordPress NoFollow jQuery Links plugin to the latest available version at least 1.4.1...

method-crm (0.1.0) potentially affected by CVE-2021-37504 via jquery-file-upload (4.0.11)

jquery-file-upload NPM version 4.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on jquery-file-upload and may be impacted: - method-crm 0.1.0 Source cves: CVE-2021-37504 Source advisory: GHSA-43X9-7HFV-MXRF...

method-crm (0.1.0) potentially affected by CVE-2021-37504 via jquery-file-upload (4.0.11)

jquery-file-upload NPM version 4.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on jquery-file-upload and may be impacted: - method-crm 0.1.0 Source cves: CVE-2021-37504 Source advisory: OSV:GHSA-43X9-7HFV-MXRF...

jQuery-Upload-File XSS in fileNameStr

A cross-site scripting XSS vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name...

GHSA-43X9-7HFV-MXRF jQuery-Upload-File XSS in fileNameStr

A cross-site scripting XSS vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name...

CVE-2021-37504

A cross-site scripting XSS vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name...

CVE-2021-37504

A cross-site scripting XSS vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name...

CVE-2021-37504

A cross-site scripting XSS vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name...

Cross site scripting

A cross-site scripting XSS vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name...

CVE-2021-37504

A cross-site scripting XSS vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name...

CVE-2021-37504

A cross-site scripting XSS vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name...

CVE-2021-37504

CVE-2021-37504 concerns an XSS in the fileNameStr parameter of the jQuery-Upload-File library (v4.0.11). Multiple connected sources corroborate that a crafted file name containing a Javascript payload can cause arbitrary web script execution. The root cause is the unsanitized fileNameStr input; e...