CVE-2024-40604

An issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via MediaWiki:Nimbus-sidebar menu and submenu entries...

PT-2024-28938

Name of the Vulnerable Software and Affected Versions MediaWiki versions through 1.42.1 Description An issue was discovered in the Tempo skin for MediaWiki. There is stored XSS via MediaWiki:Sidebar top-level menu entries. Recommendations For versions through 1.42.1, consider disabling the Tempo...

PT-2024-28941

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.42.1 and earlier Description An issue was discovered in the Foreground skin for MediaWiki. There is stored XSS via MediaWiki: Sidebar top-level menu entries. Recommendations For MediaWiki versions 1.42.1 and earlier,...

CVE-2024-40605

An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40605

An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40602

An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

PT-2024-35748

Name of the Vulnerable Software and Affected Versions Flatsome theme for WordPress versions up to, and including, 3.18.7 Description The issue is related to Stored Cross-Site Scripting via the UX Countdown, Video Button, UX Video, UX Slider, UX Sidebar, and UX Payment Icons shortcodes due to...

CVE-2024-5224: Improper Neutralization of Input During Web Page Generation

The Easy Social Like Box – Popup – Sidebar Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cardozafacebooklikebox' shortcode in all versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes...

WordPress plugin Easy Social Like Box - Popup - Sidebar Widget Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Easy Social Like Box plugin <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin Easy Social Like Box – Popup – Sidebar Widget versions = 4.0...

WordPress Easy Social Like Box – Popup – Sidebar Widget Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS)

Software Easy Social Like Box – Popup – Sidebar Widget Type Plugin Vulnerable versions = 4.0 Fixed in 4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5224 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 595d5823e3e8 Credit...

BIT-MEDIAWIKI-2021-45473

In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL aka a page-information sidebar...

BIT-DISCOURSE-2023-36818

Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This issue has been patched in commit 52b003d915. Users are advised to upgrade. There are no known workarounds for this vulnerability...

Hubbub Lite < 1.32.0 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup As admin, enable the 'Floating Sidebar...

CVE-2023-5831

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all versions starting from 16.5.0 before 16.5.1 which have the supersidebarloggedout feature flag enabled. Affected versions with this...

PT-2023-32363 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 16.0 through 16.3.5 GitLab CE/EE versions 16.4 through 16.4.1 GitLab CE/EE versions 16.5.0 Description: An issue has been discovered in GitLab CE/EE which may unintentionally disclose GitLab version metadata to...

Malicious code in fixed-sidebar-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a886a2b249fe5866154125cdc1f0b7eca75a596ae19cc5b57d215b5eda4cb21d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in fixed-sidebar-modal

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2023-36818

Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This issue has been patched in commit 52b003d915. Users are advised to upgrade. There are no known workarounds for this vulnerability...

CVE-2023-36818 Denial of service via User Custom Sidebar Section Unlimited Link Creation in discourse

Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This issue has been patched in commit 52b003d915. Users are advised to upgrade. There are no known workarounds for this vulnerability...