WordPress Website Content in Page or Post Plugin < 2024.04.09 is vulnerable to Cross Site Scripting (XSS)

Software Website Content in Page or Post Type Plugin Vulnerable versions 2024.04.09 Fixed in 2024.04.09 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2430 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4eb2dd387d32 Credits...

CVE-2023-2455

...

CVE-2024-39545

The CVE describes an Improper Check for Unusual or Exceptional Conditions in Juniper Networks Junos OS iked (on SRX Series, MX Series with SPC3, and NFX350), where unauthenticated network-based attackers can trigger an iked crash during IPsec negotiations by sending specific mismatching parameter...

CVE-2024-23317

The CVE-2024-23317 issue affects Gallagher Controller 6000 and Controller 7000 (versions 8.60 and earlier; 8.70 before 8.70.240520a; 8.80 before 8.80.240520a; 8.90 before 8.90.240520a; 9.00 before 9.00.240521a; 9.10 before 9.10.240520a). Root cause is External Control of File Name or Path (CWE-73...

CVE-2024-23317: External Control of File Name or Path

External Control of File Name or Path CWE-73 in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arbitrary code execution. This issue affects: 9.10 prior to vCR9.10.240520a distributed in 9.10.1268MR1, 9.00 prior to vCR9.00.240521a...

CVE-2024-38049: External Control of File Name or Path

Windows Distributed Transaction Coordinator Remote Code Execution Vulnerability...

CVE-2024-5855: Missing Authorization

The Media Hygiene: Remove or Delete Unused Images and More! plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the bulkactiondelete and deletesingleimagecall AJAX actions in all versions up to, and including, 3.0.1. This makes it possible for...

CVE-2024-39474: Allocation of Resources Without Limits or Throttling

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix vmalloc which may return null if called with GFPNOFAIL commit a421ef303008 "mm: allow !GFPKERNEL allocations for kvmalloc" includes support for GFPNOFAIL, but it presents a conflict with commit dd544141b9eb...

CVE-2024-39477: Allocation of Resources Without Limits or Throttling

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not call vmaaddreservation upon ENOMEM sysbot reported a splat 1 on unmaphugepagerange. This is because vmaneedsreservation can return -ENOMEM if allocatefileregionentries fails to allocate the fileregion struct fo...

CVE-2024-39929: Improper Encoding or Escaping of Output

Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mimefilename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users...

CVE-2024-38475: Improper Encoding or Escaping of Output

Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure...

CVE-2023-42011: Improper Restriction of Rendered UI Layers or Frames

IBM Sterling B2B Integrator Standard Edition 6.1 and 6.2 does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. IBM X-Force ID: 265508...

CVE-2024-0949: Missing Authentication for Critical Function

Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass. This issue affects Elektraweb: before v17.0.68...

CVE-2024-38874: Protection Mechanism Failure

An issue was discovered in the events2 aka Events 2 extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference IDOR vulnerability with the potential to activate or delete various events for unauthenticated user...

CVE-2024-6176: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in LG Electronics LG SuperSign CMS allows Port Scanning.This issue affects LG SuperSign CMS: from 4.1.3 before 4.3.1...

UBUNTU-CVE-2024-38603

In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi: hns3: Actually use devmaddactionorreset pciallocirqvectors allocates an irq vector. When devmaddaction fails, the irq vector is not freed, which leads to a memory leak. Replace the devmaddaction with...

The vulnerability of the remote access and file replication server 12d Synergy Server, 12d Synergy File Replication Server, is related to the absence of quotation marks in the names of elements or search paths. This allows attackers to exploit this flaw to gain higher privileges.

The vulnerability of the remote access and file replication server 12d Synergy Server lies in the absence of quotation marks in the names of elements or search paths. Exploiting this vulnerability can allow a malicious actor to gain increased privileges...

CVE-2024-4315: Improper Limitation of a Pathname to a Restricted Directory

parisneo/lollms version 9.5 is vulnerable to Local File Inclusion LFI attacks due to insufficient path sanitization. The sanitizepathfromendpoint function fails to properly sanitize Windows-style paths backward slash , allowing attackers to perform directory traversal attacks on Windows systems...

CVE-2024-3149 SSRF in mintplex-labs/anything-llm

A Server-Side Request Forgery SSRF vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded links through an internal Collector API using a headless browser. An attacker can exploit this by...

CVE-2024-5262 ProjectDiscovery Interactsh - Files or Directories Accessible to External Parties

Files or Directories Accessible to External Parties vulnerability in smb server in ProjectDiscovery Interactsh allows remote attackers to read/write any files in the directory and subdirectories of where the victim runs interactsh-server via anonymous login...