WordPress plugin KiviCare SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

The vulnerability of the eval() function in the Widget Options plugin of the WordPress content management system allows a hacker to execute arbitrary code.

The vulnerability of the eval function in the Widget Options plugin of the WordPress content management system is related to improper handling of code generation due to incorrect validation of input data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

WordPress AI Quiz plugin <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by vgo0 in WordPress Plugin AI Quiz versions = 1.1...

WordPress Advanced Options Editor plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin Advanced Options Editor versions = 1.0...

Security update for docker-stable

This update for docker-stable fixes the following issues: Remove DOCKERNETWORKOPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases. Update --add-runtime to point to correct binary path. Further merge docker and...

SUSE-SU-2024:4205-1 Security update for docker-stable

This update for docker-stable fixes the following issues: - Remove DOCKERNETWORKOPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases. - Update --add-runtime to point to correct binary path. - Further merge docker a...

Security update for docker-stable

This update for docker-stable fixes the following issues: CVE-2024-41110: Fixed Authz zero length regression bsc1228324. Bug fixes: Allow users to disable SUSE secrets support by setting DOCKERSUSESECRETSENABLE=0 in /etc/sysconfig/docker bsc1231348. Import specfile changes for docker-buildx as we...

SUSE-SU-2024:4204-1 Security update for docker-stable

This update for docker-stable fixes the following issues: - CVE-2024-41110: Fixed Authz zero length regression bsc1228324. Bug fixes: - Allow users to disable SUSE secrets support by setting DOCKERSUSESECRETSENABLE=0 in /etc/sysconfig/docker bsc1231348. - Import specfile changes for docker-buildx...

CVE-2024-11643 Accessibility by AllAccessible <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Update

The Accessibility by AllAccessible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'AllAccessiblesavesettings' function in all versions up to, and including, 1.3.4. This makes it possible for...

CVE-2024-11643 Accessibility by AllAccessible <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Update

The Accessibility by AllAccessible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'AllAccessiblesavesettings' function in all versions up to, and including, 1.3.4. This makes it possible for...

CVE-2024-11643

The CVE-2024-11643 entry concerns the WordPress plugin Accessibility by AllAccessible up to version 1.3.4. The connected sources confirm a missing capability check in AllAccessible_save_settings that lets authenticated users with Subscriber+ privileges modify arbitrary options, enabling privilege...

SUSE CVE-2024-35366

FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parseoptions function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds...

PT-2024-16370 · WordPress · Ti Woocommerce Wishlist

Name of the Vulnerable Software and Affected Versions: TI WooCommerce Wishlist plugin for WordPress versions prior to 2.9.2 Description: The issue concerns a missing capability check in the wizard function, allowing unauthenticated attackers to create new pages, modify plugin settings, and perfor...

FFmpeg parse_options integer overflow vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. An integer overflow vulnerability exists in FFmpeg parseoptions, which can be exploited by an attacker to submit a special file and trick the user into parsing it, which can crash the...

rails-html-sanitizer has XSS vulnerability with certain configurations

Summary There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails = 7.1.0. Versions affected: 1.6.0 Not affected: 1.6.0 Fixed versions: 1.6.1 Impact A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may...

GHSA-J5G2-Q29X-CW3H SimpleSAMLphp vulnerable to XXE in parsing SAML messages

Withdrawn Advisory This advisory has been withdrawn because the vulnerability affects users of the SimpleSAMLphp tarball, not the SimpleSAMLphp Composer package. The underlying information about CVE-2024-52596 is still valid. Original Description Summary When loading an untrusted XML document, fo...

Exploit for CVE-2024-8672

CVE-2024-8672: Authenticated Contributor Remote Code Execution...

SimpleSAMLphp SAML2 has an XXE in parsing SAML messages

Summary When loading an untrusted XML document, for example the SAMLResponse, it's possible to induce an XXE. $options is defined as: https://github.com/simplesamlphp/saml2/blob/717c0adc4877ebd58428637e5626345e59fa0109/src/SAML2/DOMDocumentFactory.phpL41 including the DTDLoad option, which allows...

GHSA-2X65-FPCH-2FCM SimpleSAMLphp xml-common XXE vulnerability

Summary When loading an untrusted XML document, for example the SAMLResponse, it's possible to induce an XXE. $options is defined as: https://github.com/simplesamlphp/xml-common/blob/v1.19.0/src/DOMDocumentFactory.phpL39 including the DTDLoad option, which allows an attacker to read file contents...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection due to improper sanitization of XML body in the fromString function. Workaround Remove the LIBXMLDTDLOAD | LIBXMLDTDATTR options from $options Details XXE Injection is a type of attack against an...