CVE-2021-24729

The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase...

CVE-2021-24729

The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase...

Cross site scripting

The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase...

CVE-2021-24729 Logo Showcase with Slick Slider < 1.2.4 - Author+ Stored Cross Site Scripting

The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase...

CVE-2021-24729

CVE-2021-24729 concerns the WordPress plugin “Logo Showcase with Slick Slider” (versions before 1.2.4). The vulnerability is a failure to sanitize Grid Settings, enabling stored Cross-Site Scripting via post metadata and allowing unaffiliated authors or users with low privileges to inject script....

CVE-2021-24729: Improper Neutralization of Input During Web Page Generation

The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase...

PT-2021-16232

Name of the Vulnerable Software and Affected Versions The Logo Showcase with Slick Slider WordPress plugin versions prior to 1.2.4 Description The issue allows users with a role as low as Author to perform stored Cross-Site Scripting attacks. This is due to the lack of sanitization in the Grid...

Logo Carousel < 3.4.2 - Contributor+ Stored Cross-Site Scripting

The plugin does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks 1 Make a new carousel /wp-admin/post-new.php?posttype=splcshortcodes 2 Set "Logo Margin" of the Style Setting to the...

WordPress Logo Carousel plugin <= 3.4.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Logo Carousel plugin versions = 3.4.1. Solution Update the WordPress Logo Carousel plugin to the latest available version at least 3.4.2...

Logo Carousel < 3.4.2 - Unauthorised Private Post Access

The plugin allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature 1 Go to Logo Carousel - Shortcode Generator. 2 If there is no carousel, create one. 3 Copy URL of the "Duplicate" link under the carouse...

WordPress Logo Carousel plugin <= 3.4.1 - Unauthorized Private Post Access vulnerability

Unauthorized Private Post Access vulnerability discovered by apple502j in WordPress Logo Carousel plugin versions = 3.4.1. Solution Update the WordPress Logo Carousel plugin to the latest available version at least 3.4.2...

PT-2021-8061

Name of the Vulnerable Software and Affected Versions Siemens LOGO affected versions not specified Description The issue is related to a weakness in the authentication mechanism of the Siemens LOGO programmable logic controller's embedded software, which uses a reversible one-way hash function...

PT-2021-8058

Name of the Vulnerable Software and Affected Versions Siemens LOGO affected versions not specified Description The issue is related to the use of defective cryptographic algorithms in the embedded software of Siemens LOGO programmable logic controllers. This could allow a remote attacker to gain...

PT-2021-8064

Name of the Vulnerable Software and Affected Versions Siemens LOGO affected versions not specified Description The issue is related to the incorrect implementation of security functions in the user interface of the programmable logic controllers. This could allow a remote attacker to gain access ...

PT-2021-8063

Name of the Vulnerable Software and Affected Versions Siemens LOGO affected versions not specified Description The issue is related to a lack of authentication for a critical function in the embedded software of Siemens LOGO programmable logic controllers. This could allow a remote attacker to...

httpd:2.4 security update

httpd 2.4.37-43.0.1 - Set vstring per ORACLESUPPORTPRODUCT Orabug: 29892262 - Replace index.html with Oracle's index page oracleindex.html. 2.4.37-43 - Related: 2007235 - CVE-2021-40438 httpd:2.4/httpd: modproxy: SSRF via a crafted request uri-path 2.4.37-42 - Resolves: 2007235 - CVE-2021-40438...

WP Admin Logo Changer <= 1.0 - Plugin's Settings Update via CSRF

The plugin does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack. csrf.submit...

WordPress WP Admin Logo Changer plugin <= 1.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Plugin Settings Update

Cross-Site Request Forgery CSRF vulnerability leading to Plugin Settings Update discovered by apple502j in WordPress WP Admin Logo Changer plugin versions = 1.0. Solution Deactivate and delete. This plugin has been closed as of October 4, 2021 and is not available for download. This closure is...

CVE-2021-24742

The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability check...

CVE-2021-24742

The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability check...