CVE-2024-35686

The CVE-2024-35686 entry concerns a Missing Authorization vulnerability in Automattic Sensei LMS and Sensei Pro (WC Paid Courses). Connected documents provide concrete details: affected versions include Sensei LMS up to 4.23.1 and Sensei Pro (WC Paid Courses) up to 4.23.1.1.23.1. The issue is cat...

CVE-2024-42463 Leak of organizations messages

Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9...

CVE-2024-42167

The function "generateappcertificates" in controllers/saml2/saml2.js of FIWARE Keyrock = 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicio...

CVE-2024-7355

The Organization chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titleinput’ and 'nodedescription' parameter in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-7266

Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to list all users in the system, including those from other organizations. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17...

WordPress Organization chart plugin <= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title_input and node_description Parameters vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via titleinput and nodedescription Parameters vulnerability discovered by Norbert Hofmann in WordPress Plugin Organization chart versions = 1.5.0...

PT-2024-38286 · WordPress · Organization Chart Plugin

Name of the Vulnerable Software and Affected Versions: Organization chart plugin for WordPress versions up to, and including, 1.5.0 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with Subscriber-level access and above to...

WordPress plugin Organization chart 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress Organization chart Plugin <= 1.5.0 is vulnerable to Cross Site Scripting (XSS)

Software Organization chart Type Plugin Vulnerable versions = 1.5.0 Fixed in 1.5.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7355 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 14d785205026 Credits Norbert Hofmann...

sameeeksha.org Cross Site Scripting vulnerability OBB-3950590

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Important: emacs

Issue Overview: In Emacs before 29.3, Gnus treats inline MIME contents as trusted. CVE-2024-30203 In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments. CVE-2024-30204 In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode...

PT-2024-18969 · Gitpod · Gitpod

Name of the Vulnerable Software and Affected Versions: github.com/gitpod-io/gitpod/components/server/go/pkg/lib versions before main-gha.27122 github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy versions before main-gha.27122 github.com/gitpod-io/gitpod/install/installer/pkg/components/auth...

CVE-2023-7012

CVE-2023-7012 affects Google Chrome’s Permission Prompts due to insufficient data validation, potentially enabling a sandbox escape when a user runs a malicious app. Described for Chrome versions before 117.0.5938.62; exploitation requires user interaction and a malicious file. Astra Linux bullet...

CVE-2024-3176

CVE-2024-3176 affects Google Chrome with an out-of-bounds write in SwiftShader triggered by a crafted HTML page, enabling remote memory corruption. Chrome versions prior to 117.0.5938.62 are vulnerable; upgrade to 117.0.5938.62 or later to mitigate. Other connected sources corroborate the same Ch...

CVE-2019-25154

The CVE-2019-25154 entry describes an Inappropriate implementation in iframe handling in Google Chrome prior to 77.0.3865.75, which could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Affected software is Google Chrome (Chromium-based); the underlying is...

CVE-2020-36765

CVE-2020-36765 affects Google Chrome (

CVE-2024-6336

A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Server by exploiting organization ruleset feature. This attack required an organization member to explicitly change the visibility of a depende...

CVE-2024-3175

CVE-2024-3175 concerns insufficient data validation in the Chrome Extensions component, enabling privilege escalation via a crafted Chrome Extension. The primary documentation states vulnerable component as Extensions, with affected Chrome versions before 120.0.6099.62 (remediation: update to 120...

CVE-2024-3173

The CVE-2024-3173 entry describes an insufficient data validation in Chrome’s Updater, enabling OS‑level privilege escalation via a malicious file prior to Chrome 120.0.6099.62. Affected component: Updater in Google Chrome (Chromium). Root cause: insufficient input validation in updater workflow....

CVE-2024-3172

CVE-2024-3172 concerns Insufficient data validation in DevTools of Google Chrome prior to 121.0.6167.85. A remote attacker could trick a user into UI gestures to execute arbitrary code via a crafted HTML page. Affected software: Google Chrome (DevTools). Root cause: input/data validation gaps in ...