WordPress Jeg Elementor Kit plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ray Wilson Patchstack Alliance in WordPress Plugin Jeg Elementor Kit versions = 2.6.3...

WordPress Royal Elementor Kit Theme <= 1.0.116 is vulnerable to Cross Site Request Forgery (CSRF)

Software Royal Elementor Kit Type Theme Vulnerable versions = 1.0.116 Fixed in 1.0.117 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32773 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4da5c371e0b8 Credits Dhabaleshwar...

WordPress Jeg Elementor Kit Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)

Software Jeg Elementor Kit Type Plugin Vulnerable versions = 2.6.3 Fixed in 2.6.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32721 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c3bc2ac365dc Credits Ray Wilson Required privilege...

Vulnerabilities fixed in Oracle Systems

Oracle has fixed vulnerabilities in components of System Software. A malicious person with physical access to the hardware, or local access to the infrastructure, can exploit the vulnerabilities to exploit attacks that could result in the following categories of damage: Cross-Site Scripting XSS...

droplinked-payment-hub (>=0.1.3, <=0.2.37), droplinked-web3 (>=0.0.1, <=5.0.2) +3 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.88.0)

@solana/web3.js NPM version 1.88.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - droplinked-payment-hub =0.1.3, =0.0.1, =0.0.1, =0.0.1, =0.0.26 - expand-network 3.0.2 Source cves: CVE-2024-30253 Source advisory:...

droplinked-payment-hub (>=0.1.3, <=0.2.37), droplinked-web3 (>=0.0.1, <=5.0.2) +3 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.88.0)

@solana/web3.js NPM version 1.88.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - droplinked-payment-hub =0.1.3, =0.0.1, =0.0.1, =0.0.1, =0.0.26 - expand-network 3.0.2 Source cves: CVE-2024-30253 Source advisory:...

Exploit for SQL Injection in Wpdirectorykit Wp_Directory_Kit

CVE-2024-3217-POC Mitre Description The WP Directory Kit...

OpenJDK: long Exception message leading to crash (8319851)

A flaw was found in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalV...

CVE-2024-32505

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet Elements kit Elementor addons allows Stored XSS.This issue affects Elements kit Elementor addons: from n/a through 3.0.6...

CVE-2024-32505

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Roxnor ElementsKit Elementor addons Lite elementskit-lite.This issue affects ElementsKit Elementor addons Lite: from n/a through = 3.0.6...

PT-2024-24622 · Unknown · Wpmet Elements Kit Elementor Addons

Name of the Vulnerable Software and Affected Versions: Wpmet Elements kit Elementor addons versions 3.0.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means an attack...

CVE-2024-21104

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems component: Core. The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle ZFS Storage Appliance Kit executes to...

CVE-2024-21104

The CVE-2024-21104 affects Oracle ZFS Storage Appliance Kit, Core component, v8.8. The issue stems from insufficient input validation in the Core, enabling a high-privilege attacker with logon access to compromise the kit (requires user interaction) and potentially take over the appliance. Exploi...

CVE-2024-21104: Undefined Security Weakness

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems component: Core. The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle ZFS Storage Appliance Kit executes to...

PT-2024-4905 · Oracle · Oracle Zfs Storage Appliance Kit

Name of the Vulnerable Software and Affected Versions: Oracle ZFS Storage Appliance Kit version 8.8 Description: The issue is related to insufficient input validation in the Core component of the Oracle ZFS Storage Appliance Kit. This allows a high-privileged attacker with logon access to the...

WordPress Elements kit Elementor addons Plugin <= 3.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Elements kit Elementor addons Type Plugin Vulnerable versions = 3.0.6 Fixed in 3.0.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32505 Patch priority Low CVSS severity Low 6.5 Developer Wpmet PSID 33d2dde71d0d Credits Ngô Thiên An ancorn from VNPT-VCI...

PT-2024-3146 · WordPress · Jeg Elementor Kit

Name of the Vulnerable Software and Affected Versions: Jeg Elementor Kit plugin for WordPress versions up to, and including, 2.6.4 Description: The issue is related to insufficient input sanitization and output escaping on user-supplied attributes in the JKit - Banner widget, allowing authenticat...

Malware in @sber-site/sbercraft-nova-kit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @sber-site/sbercraft-nova-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1991e996cd5b0d203989782e11320a1706f3fd9f5e0ca3853513e5051ae8486 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-2334 Template Kit – Import <= 1.0.14 - Authenticated(Author+) Stored Cross-Site Scripting via template upload

The Template Kit – Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template upload functionality in all versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with autho...