WordPress WP Search Analytics Plugin <= 1.4.10 is vulnerable to Cross Site Scripting (XSS)

Software WP Search Analytics Type Plugin Vulnerable versions = 1.4.10 Fixed in 1.4.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9209 Patch priority Medium CVSS severity Medium 7.1 Developer Cornel Raiu PSID 95b75262f4d2 Credits vgo0 Required...

WordPress Hello World Plugin <= 2.1.1 is vulnerable to Arbitrary File Download

Software Hello World Type Plugin Vulnerable versions = 2.1.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-9224 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 936cc3342bfb Credits yudha Required privilege...

WordPress DK PDF Plugin <= 1.9.6 is vulnerable to Cross Site Scripting (XSS)

Software DK PDF Type Plugin Vulnerable versions = 1.9.6 Fixed in 1.9.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8727 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ce80562602cc Credits vgo0 Required privilege...

WordPress Auto Featured Image from Title Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)

Software Auto Featured Image from Title Type Plugin Vulnerable versions = 2.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8786 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2889e0c9e9d2 Credits vgo0...

CVE-2024-46862

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-mtl-match: add missing empty item There is no linksnum in struct sndsocacpimach , and we test !link-numadr as a condition to end the loop in hdasdwmachineselect. So an empty item in struct...

CVE-2024-46837

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Restrict high priorities on groupcreate We were allowing any users to create a high priority group without any permission checks. As a result, this was allowing possible denial of service. We now only allow the DRM...

CVE-2024-8118

In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules...

September 26, 2024—KB5043145 (OS Builds 22621.4249 and 22631.4249) Preview

None None...

CVE-2024-46461

VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream heap based overflow. If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the...

CVE-2024-39842

creationtimestamp| type| source ---|---|--- 2024-09-23 22:10:29+00:00| seen| https://t.me/cvedetector/6206 2024-10-08 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1322/ 2024-11-06 06:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1460/ 2024-11-06...

CVE-2024-45182

creationtimestamp| type| source ---|---|--- 2024-09-12 21:53:42+00:00| seen| https://t.me/cvedetector/5519 2024-10-10 12:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-09...

CVE-2024-45004

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix leak of blob encryption key Trusted keys unseal the key blob on load, but keep the sealed payload in the blob field so that every subsequent read export will simply convert this field to hex and send it to...

CVE-2024-44968

In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Move per CPU pointer access into the atomic section The recent fix for making the take over of the broadcast timer more reliable retrieves a per CPU pointer in preemptible context. This went unnoticed as compilers...

Oracle DB SQL Injection Via SYS.DBMS_CDC_PUBLISH.ALTER_AUTOLOG_CHANGE_SOURCE

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle DB SQL Injection via SYS.DBMSCDCPUBLISH.ALTERAUTOLOGCHANGESOURCE', 'Description' = %q The module exploits an sql injection flaw in the...

August 27, 2024—KB5041587 (OS Builds 22621.4112 and 22631.4112) Preview

None None...

CVE-2024-25837

A stored cross-site scripting XSS vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section...

CVE-2024-25837

A stored cross-site scripting XSS vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section...

PT-2024-21149 · Octobercms · October Cms Bloghub Plugin

Name of the Vulnerable Software and Affected Versions: October CMS Bloghub Plugin versions 1.3.8 and lower Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section. This can lead to the execution...

CVE-2024-25837

A stored cross-site scripting XSS vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section...

CVE-2024-25837

A stored cross-site scripting XSS vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section...