WordPress Message Filter for Contact Form 7 plugin <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions vulnerability

Missing Authorization to Authenticated Subscriber+ Filter Updates/Deletions vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin Message Filter for Contact Form 7 versions = 1.6.3...

WordPress ElementsReady Addons for Elementor plugin <= 6.4.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin ElementsReady Addons for Elementor versions = 6.4.7...

Malicious code in coldbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8841e2d0dbc754df7eb19a7b42426c538506e0fc7412d08422bbd8f2cf983d73 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost versions 9.7.x through 9.7.5, 9.8.x through 9.8.2, and 9.9.x through 9.9.2, which stems from an inability to properly propagate privilege scheme updates...

SUSE CVE-2024-53986

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails = 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitiz...

DesDev DedeCMS 代码注入漏洞

DesDev DedeCMS Dream Weaving Content Management System is a PHP-based open source content management system CMS from China Zhuozhuo DesDev. The system has features such as content publishing, content management, content editing and content retrieval. A code injection vulnerability exists in DesDe...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the improper sanitization of HTML elements and attributes. An attacker can inject malicious scripts by exploiting the overridden sanitizer configurations that allow certain HTML5 elements. Note Exploiting...

Security update for php7

This update for php7 fixes the following issues: CVE-2024-11233: Single byte overread with convert.quoted-printable-decode filter bsc1233702. CVE-2024-11234: Configuring a proxy in a stream context might allow for CRLF injection in URIs bsc1233703. CVE-2024-8929: Leak partial content of the heap...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the improper sanitization of HTML elements and attributes. An attacker can inject malicious scripts by exploiting the overridden sanitizer configurations that allow certain HTML5 noscript element Note: Th...

UBUNTU-CVE-2024-53986

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails = 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitiz...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper user input sanitization. Note Exploiting this vulnerability is only possible when the following are true: 1 HTML5 sanitization is enabled 2 The application developer has overridden the sanitizer'...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the improper sanitization of HTML elements and attributes. An attacker can inject malicious scripts by exploiting the overridden sanitizer configurations that allow certain HTML5 elements such as math,...

UBUNTU-CVE-2024-53989

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails = 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitiz...

Security update for the Linux Kernel RT (Live Patch 7 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505001324 fixes several issues. The following security issues were fixed: CVE-2021-47517: Fix panic when interrupt coaleceing is set via ethtool bsc1225429. CVE-2024-36904: tcp: Use refcountincnotzero in tcptwskunique bsc1225733. CVE-2024-43861: Fix memor...

WordPress WordPress Auction Plugin plugin <= 3.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Hakiduck Patchstack Alliance in WordPress Plugin WordPress Auction Plugin versions = 3.7...

WordPress NEX-Forms plugin <= 8.7.8 - SQL Injection vulnerability

SQL Injection vulnerability discovered by trongnb02 Patchstack Alliance in WordPress Plugin NEX-Forms versions = 8.7.8...

WordPress FloristPress plugin <= 7.3.0 - Nonce Leakage to Broken Access Control vulnerability

Nonce Leakage to Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin FloristPress versions = 7.3.0...

PT-2024-35304 · Unknown · Anmari Amr Shortcodes

Name of the Vulnerable Software and Affected Versions: anmari amr shortcodes versions 1.7 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This enables attackers to injec...

PT-2024-35997

Name of the Vulnerable Software and Affected Versions: rails-html-sanitizer version 1.6.0 Description: The issue is related to a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer when used with Rails = 7.1.0 and Nokogiri = 1.16.8...

Rails HTML Sanitizers 跨站脚本漏洞

Rails HTML Sanitizers is an HTML cleanup tool from the US Rails team for use in Rails applications. A cross-site scripting vulnerability exists in Rails HTML Sanitizers version 1.6.0, which stems from a vulnerability to a cross-site scripting attack that could allow an attacker to inject content...