13919 matches found
CVE-2024-5263 ElementsKit Elementor addons and Templates Library <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table Widgets
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Motion Text and Table widgets in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-5263 ElementsKit Elementor addons and Templates Library <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table Widgets
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Motion Text and Table widgets in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
PT-2024-35403 · WordPress · Elementskit Pro
Name of the Vulnerable Software and Affected Versions: ElementsKit Pro plugin for WordPress versions up to, and including, 3.6.2 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the Motion Text and Table widgets. This allows...
ibus-table bug fix and enhancement update
An update is available for ibus-table. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 8...
WordPress Restaurant Menu and Food Ordering plugin <= 2.4.0 - Authenticated Stored Cross-Site Scripting via Shortcode vulnerability
Authenticated Stored Cross-Site Scripting via Shortcode vulnerability discovered by Lucio Sá in WordPress Plugin Restaurant Menu – Food Ordering System – Table Reservation versions = 2.4.0...
CVE-2024-2218
The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-2218
The CVE-2024-2218 issue affects the LuckyWP Table of Contents WordPress plugin up to version 2.1.4, where settings sanitization/escaping is insufficient, enabling admin-level Stored XSS in multisite or when unfiltered_html is disabled. Root cause: inadequate input sanitization/escapes in certain ...
CVE-2024-2218 LuckyWP Table of Contents <= 2.1.4 - Admin+ Stored XSS
The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Cross-site Scripting (XSS)
typo3/cms is vulnerable to cross-site scripting XSS. The vulnerability is due to improper handling of file extensions containing malicious sequences in the output table listing, which requires access to the server's file system either directly or through synchronization to exploit...
PT-2024-19259 · WordPress · Luckywp Table Of Contents
Name of the Vulnerable Software and Affected Versions: LuckyWP Table of Contents WordPress plugin versions 2.1.4 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability ...
WordPress Restaurant Menu – Food Ordering System – Table Reservation Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)
Software Restaurant Menu – Food Ordering System – Table Reservation Type Plugin Vulnerable versions = 2.4.0 Fixed in 2.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1399 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID...
ElementsKit Elementor addons and Templates Library < 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table Widgets
Description The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Motion Text and Table widgets in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...
Fortinet FortiClient TunnelVision - CVE-2024-3661 (FG-IR-24-170)
The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-170 advisory. - DHCP can add routes to a client's routing table via the classless static route option 121. VPN-based security solutions...
SUSE-SU-2024:2011-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctpautoasconfinit in net/sctp/socket.c bsc1218917. - CVE-2024-26828: Fixed...
CVE-2024-4146
In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the checkProjectAccess method within the...
CVE-2024-4146 Incorrect Authorization in lunary-ai/lunary
In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the checkProjectAccess method within the...
TYPO3 Cross-Site Scripting in Filelist Module
It has been discovered that the output table listing in the “Files” backend module is vulnerable to cross-site scripting when a file extension contains malicious sequences. Access to the file system of the server - either directly or through synchronization - is required to exploit the...
Cross-site Scripting (XSS)
moodle/moodle is vulnerable to Cross-site Scripting XSS. The vulnerability is due to insufficient escaping of participants' names in the participant's page table, allowing for malicious code injection when interacting with certain features...
IBM DB2 Multiple Vulnerabilities (7145722, 7145730) (Unix)
According to its self-reported version number, IBM Db2 on Unix may be affected by multiple vulnerabilites: - IBM® Db2® is vulnerable to denial of service when quering a specific UDF built-in function concurrently. CVE-2023-52296 - IBM® Db2® is vulnerable to a denial of service with a speciall...