ManageEngine ServiceDesk Plus MSP < 14.9 Build 14910

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 14.9 Build 14910. It is, therefore, affected by a vulnerability as referenced in the service-desk-mspCVE-2024-50053 advisory. - A stored cross-site scripting XSS vulnerability allowed authenticated technicia...

WordPress WP Crowdfunding plugin <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download vulnerability

Missing Authorization to Authenticated Subscriber+ Post Content Download vulnerability discovered by Krzysztof Zając in WordPress Plugin WP Crowdfunding versions = 2.1.14...

USN-7332-2: Linux kernel vulnerabilities

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service system crash or possibly execute arbitrary code...

USN-7332-2 linux-kvm vulnerabilities

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service system crash or possibly execute arbitrary code...

USN-7344-1 linux-aws, linux-aws-hwe, linux-gcp, linux-gcp-4.15, linux-kvm, linux-oracle vulnerabilities

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2024-23848 Attila Szász discovered that the HFS+ file system...

WordPress Coronavirus (COVID-19) Notice Message plugin <= 1.1.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Coronavirus COVID-19 Notice Message versions = 1.1.2...

CVE-2025-1287

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown, Syntax Highlighter, and Page Scroll widgets in all versions up to, and including, 6.2.2 due to insufficient...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-56787)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-56787 advisory. - In the Linux kernel, the following vulnerability has been resolved: soc: imx8m: Probe the SoC driver as...

CVE-2025-1287

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown, Syntax Highlighter, and Page Scroll widgets in all versions up to, and including, 6.2.2 due to insufficient...

CVE-2025-1287 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown, Syntax Highlighter, and Page Scroll widgets in all versions up to, and including, 6.2.2 due to insufficient...

CVE-2025-1287

CVE-2025-1287 concerns The Plus Addons for Elementor Page Builder Lite (and related The Plus Addons for Elementor) for WordPress. Affected: plugins in versions up to and including 6.2.2. Root cause: stored XSS via Countdown, Syntax Highlighter, and Page Scroll widgets caused by insufficient input...

WordPress plugin The Plus Addons for Elementor: Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-10428

Name of the Vulnerable Software and Affected Versions The Plus Addons for Elementor versions up to, and including, 6.2.2 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the Countdown, Syntax Highlighter, and Page Scroll...

CVE-2025-1287: Improper Neutralization of Input During Web Page Generation

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown, Syntax Highlighter, and Page Scroll widgets in all versions up to, and including, 6.2.2 due to insufficient...

USN-7325-2 linux-nvidia vulnerabilities

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service system crash or possibly execute arbitrary code...

ManageEngine ADSelfService Plus Auth Bypass

The vulnerability of the ManageEngine ADSelfService Plus password reset software is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain access to user accounts remotely...

USN-7323-2 linux-azure vulnerabilities

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service system crash or possibly execute arbitrary code...

How I became a Cyber Essentials Plus assessor

TL;DR What is Cyber Essentials and why does it matter? The role of Cyber Essentials CE and Cyber Essentials Plus CE+ assessors in protecting UK businesses The difference between a CE and CE+ assessor Becoming a CE assessor Becoming a CE+ assessor Challenges I faced and tips for success Introducti...

CVE-2025-26182

An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file...

CVE-2025-25115

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Zeshan Abdullah Like dislike plus counter like-dislike-plus-counter allows Stored XSS.This issue affects Like dislike plus counter: from n/a through = 1.0...