WordPress Deliver via Shipos for WooCommerce plugin <= 2.1.7 - Reflected Cross-Site Scripting via dvsfw_bulk_label_url Parameter vulnerability

Reflected Cross-Site Scripting via dvsfwbulklabelurl Parameter vulnerability discovered by vgo0 in WordPress Plugin Deliver via Shipos for WooCommerce versions = 2.1.7...

CVE-2024-9502: Improper Neutralization of Input During Web Page Generation

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Tooltip module in all versions up to, and including, 2.0.6.7 due to insufficient input sanitization and...

PT-2025-42561

Name of the Vulnerable Software and Affected Versions mediawiki affected versions not specified Description The software contains a flaw related to the escaping of the submit button label for Codex-based HTML forms. This could potentially lead to issues with how the submit button is displayed or...

PT-2024-17426 · WordPress · Smsa Shipping

Name of the Vulnerable Software and Affected Versions: SMSA Shipping plugin for WordPress versions up to, and including, 2.2 Description: The SMSA Shipping plugin for WordPress has a flaw in the smsa delete label function due to insufficient file path validation. This issue allows authenticated...

WordPress plugin SMSA Shipping(official) 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...

kernel: nfsd: ensure that nfsd4_fattr_args.context is zeroed out

A flaw was found in the Linux kernel's nfsd component. A local attacker with low privileges could exploit a vulnerability where uninitialized stack data is improperly freed. This issue can lead to a system crash, resulting in a denial of service...

CVE-2024-56319

In Matter aka connectedhomeip or Project CHIP through 1.4.0.0 before e3277eb, unlimited user label appends in a userlabel cluster can lead to a denial of service resource exhaustion...

CVE-2024-56319

In Matter aka connectedhomeip or Project CHIP through 1.4.0.0 before e3277eb, unlimited user label appends in a userlabel cluster can lead to a denial of service resource exhaustion...

CVE-2024-56319

The Matter (also known as connectedhomeip or Project CHIP ) connectivity standard is vulnerable in versions 1.4.0.0 and earlier, specifically before commit e3277eb . The root cause is the ability to perform unlimited user label appends within a userlabel cluster , which can lead to a denial of se...

Malicious code in label-merge-conflicts-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0f4e7055373f34da86b2f4a870acff07073a74806372655dd69ac315c6c598d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Reachable assertion in avahi_escape_label

...

GHSA-H97M-WW89-6JMQ `idna` accepts Punycode labels that do not produce any non-ASCII when decoded

idna 0.5.0 and earlier accepts Punycode labels that do not produce any non-ASCII output, which means that either ASCII labels or the empty root label can be masked such that they appear unequal without IDNA processing or when processed with a different implementation and equal when processed with...

CVE-2024-9371: Improper Neutralization of Input During Web Page Generation

The Branda – White Label & Branding, Custom Login Page Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 3.4.19. This makes it possible for unauthenticated...

GoCast name parameter OS command injection vulnerability

Talos Vulnerability Report TALOS-2024-1960 GoCast name parameter OS command injection vulnerability November 21, 2024 CVE Number CVE-2024-28892 SUMMARY An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary comman...

Vegam 4i 安全漏洞

Vegam 4i is an IoT data tool from Vegam. A security vulnerability exists in Vegam 4i v.6.3.47.0 and prior versions, which stems from a vulnerability that could allow a remote attacker to gain access to sensitive information via the Print Label feature...

PT-2024-34545 · Vegam 4I · Vegam 4I

Name of the Vulnerable Software and Affected Versions: Vegam 4i versions 6.3.47.0 and earlier Description: A Local File Inclusion issue allows a remote attacker to obtain sensitive information through the print label function. The filePathList parameter is susceptible to this issue, enabling a...

CVE-2024-51163

A Local File Inclusion vulnerability in Vegam Solutions Vegam 4i versions 6.3.47.0 and earlier allows a remote attacker to obtain sensitive information through the print label function. Specifically, the filePathList parameter is susceptible to LFI, enabling a malicious user to include files from...

WordPress DK White Label plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika in WordPress Plugin DK White Label versions = 1.0...

Harbor 授权问题漏洞

Harbor is an open source registry from Harbor Open Source. Artifacts are protected through policies and role-based access control to ensure that images are scanned and are not vulnerable, and that images are signed as trusted. Harbor suffers from an authorization issue vulnerability that stems fr...

Harbor 授权问题漏洞

Harbor is an open source registry from Harbor Open Source. Artifacts are protected through policies and role-based access control to ensure that images are scanned and are not vulnerable, and that images are signed as trusted. Harbor suffers from an authorization issue vulnerability that stems fr...