CVE-2022-30533

CVE-2022-30533 affects the WordPress Modern Events Calendar Lite plugin (versions before 6.3.0). Vulnerability type: authenticated stored cross-site scripting (XSS) in the plugin, enabling an authenticated attacker to inject arbitrary scripts that run in a victim’s browser via unspecified vectors...

CVE-2022-30533

Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject an arbitrary script via unspecified vectors...

CVE-2022-29524

Out-of-bounds write vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file...

CVE-2022-1604

The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

Debian DSA-5160-1 : ntfs-3g - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5160 advisory. - ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+5123-2. NOTE: the upstream position is that ntfsck is deprecated;...

WordPress Motopress Hotel Booking Lite 4.2.4 Cross Site Scripting

Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - Stored Cross-Site Scripting XSS Date: 2022-06-05 Exploit Author: Sanjay Singh Vendor Homepage: https://motopress.com/ Software Link: https://downloads.wordpress.org/plugin/motopress-hotel-booking-lite.4.2.4.zip Version: 4.2.4...

WordPress Motopress Hotel Booking Lite 4.2.4 Plugin - Stored Cross-Site Scripting Vulnerability

Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - Stored Cross-Site Scripting XSS Exploit Author: Sanjay Singh Vendor Homepage: https://motopress.com/ Software Link: https://downloads.wordpress.org/plugin/motopress-hotel-booking-lite.4.2.4.zip Version: 4.2.4 Tested on:...

An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when using libfuse-lite.

...

A file handle created in fuse_lib_opendir and later used in fuse_lib_readdir enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite.

...

An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G through 2021.8.22 when using libfuse-lite.

...

Integer Underflow

ntfs is vulnerable to integer underflow. The vulnerability exists in fuselibreaddir which allows an attacker to read arbitrary memory read operations in NTFS-3G when using libfuse-lite...

Unchecked Return Value

ntfs-3g is vulnerable to unchecked return value. The vulnerability exists due to an invalid return code in fusekernmount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G when using libfuse-lite...

Privilege Escalation

ntfs-3g is vulnerable to privilege escalation. A file handle created in fuselibopendir, and later used in fuselibreaddir, enables arbitrary memory read and write operations in NTFS-3G when using libfuse-lite...

CVE-2022-30783

A vulnerability was found in NTFS-3G. An invalid return code in fusekernmount allows libfuse-lite protocol traffic between NTFS-3G and the kernel to be intercepted...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : NTFS-3G vulnerabilities (USN-5463-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5463-1 advisory. It was discovered that NTFS-3G incorrectly handled the ntfsck tool. If a user or automated system were tricked into using ntfsck ...

Wordpress Modern Events Calendar Lite plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. A cross-site scripting vulnerability exists in the Wordpress Modern Events Calendar Lite plugin, which stems...

OESA-2022-1685 ntfs-3g security update

NTFS-3G is a stable, open source, GPL licensed, POSIX, read/write NTFS driver for Linux and many other operating systems. It provides safe handling of the Windows XP, Windows Server 2003, Windows 2000, Windows Vista, Windows Server 2008 and Windows 7 NTFS file systems. Security Fixes: ntfsck in...

WordPress Plugin "Modern Events Calendar Lite" vulnerable to cross-site scripting

Overview WordPress Plugin "Modern Events Calendar Lite" provided by Webnus contains a stored cross-site scripting vulnerability CWE-79. Tsutomu Aramaki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

JVN#04155116: WordPress Plugin "Modern Events Calendar Lite" vulnerable to cross-site scripting

WordPress Plugin "Modern Events Calendar Lite" provided by Webnus contains a stored cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is accessing the website using the plugin. Solution Update the plugin Update the plugin to t...

WordPress Modern Events Calendar Lite plugin < 6.3.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Tsutomu Aramaki Mitsui Bussan Secure Directions, Inc in WordPress Modern Events Calendar Lite plugin versions 6.3.0. Solution Fixed in version 6.3.0, but the plugin is closed. This plugin has been closed as of May 11, 2022...