CVE-2024-24843

CVE-2024-24843 is a CSRF vulnerability in PowerPack Pro for Elementor (PowerPack Addons for Elementor) affecting versions before 2.10.8. Exploitation could allow unauthorized changes to plugin settings (and associated XSS impact per patched disclosure). The fix is to upgrade to PowerPack Pro for ...

PT-2024-20909 · Emlog Pro · Emlog Pro

Name of the Vulnerable Software and Affected Versions: Emlog Pro version 2.2.8 Description: The issue is related to a Stored XSS vulnerability in the article publishing feature, caused by the non-filtering of quoted content. Recommendations: For Emlog Pro version 2.2.8, update to a newer version...

CVE-2024-25381

There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content...

CVE-2024-25381

There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content...

CVE-2024-25381

There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content...

WordPress File Manager Pro Plugin <= 8.3.4 is vulnerable to Cross Site Scripting (XSS)

Software File Manager Pro Type Plugin Vulnerable versions = 8.3.4 Fixed in 8.3.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7015 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 809f77f5638f Credits Tobias Weißhaar...

PT-2024-20611 · Unknown · Powerpack Pro For Elementor

Name of the Vulnerable Software and Affected Versions: PowerPack Pro for Elementor versions prior to 2.10.8 Description: A Cross-Site Request Forgery CSRF issue affects the PowerPack Pro for Elementor. This issue allows for malicious requests to be made on behalf of a user without their knowledge...

emlog Security Vulnerabilities

emlog is a PHP and MySQL based CMS builder for emlog personal developers. A security vulnerability exists in emlog Pro version 2.2.8, which stems from unfiltered quoted content. The vulnerability can be exploited by attackers to perform cross-site scripting attacks...

CVE-2024-25381

CVE-2024-25381 : A stored XSS vulnerability exists in Emlog Pro 2.2.8 Article Publishing due to non-filtering of quoted content. Affected component: article publishing feature in Emlog Pro 2.2.8. Root cause: input containing quoted content is not properly sanitized, enabling injection of script t...

CVE-2024-0794 Certain LaserJet Pro, HP Enterprise LaserJet, HP LaserJet Managed Printers – Potential Buffer Overflow, Potential Remote Code Execution

Certain HP LaserJet Pro, HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to Remote Code Execution due to buffer overflow when rendering fonts embedded in a PDF file...

CVE-2024-0794

HP CVE-2024-0794 affects HP LaserJet Pro, HP Enterprise LaserJet, and HP LaserJet Managed Printers. The issue is a buffer overflow in the CFF/font rendering path when parsing embedded fonts in PDFs, leading to Remote Code Execution. Public sources describe network-adjacent or remote exploitation ...

File Manager Pro < 8.3.5 - Reflected Cross-Site Scripting

Description The File Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tb' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

Hp LaserJet Pro Printer Security Vulnerability

The HP Hp LaserJet Pro Printer is a laser printer from Hewlett-Packard HP in the United States. A security vulnerability exists in the Hp LaserJet Pro Printer that stems from a buffer overflow vulnerability that can be exploited by an attacker to execute remote code...

gimp: psp off-by-one RCE

A parsing vulnerability was found in the GNU Image Manipulation Program GIMP. This flaw allows an unauthenticated, remote attacker to trick a GIMP user into opening a malicious PSP file, possibly enabling the execution of unauthorized code within the GIMP process...

Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure

Description The plugin does not prevent user with at least the contributor role from leaking other users' sensitive metadata. As a contributor, - Add shortcode to any post and specify/guess any user ID and meta key and save - Preview the post and see custom field value outputs from any user Examp...

Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure

Description The plugin does not prevent user with at least the contributor role from leaking other users' sensitive metadata. PoC As a contributor, - Add shortcode to any post and specify/guess any user ID and meta key and save - Preview the post and see custom field value outputs from any user...

Exploit for Cross-site Scripting in Kunalnagar Custom_404_Pro

I am not responsible if you use the code improperly or illegal...

CVE-2024-20734 ZDI-CAN-22516: Adobe Acrobat Pro DC AcroForm Use-After-Free Information Disclosure Vulnerability

Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction i...

CVE-2024-20734 ZDI-CAN-22516: Adobe Acrobat Pro DC AcroForm Use-After-Free Information Disclosure Vulnerability

Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction i...

CVE-2024-20736 ZDI-CAN-22822: Adobe Acrobat Pro DC AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability

Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user...