PT-2024-35963

Name of the Vulnerable Software and Affected Versions: zhmcclient versions prior to 1.18.1 Description: The Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in several cases, including when creating or updating a partition in DPM mode, updating a...

PT-2024-36055

Name of the Vulnerable Software and Affected Versions: Backdrop CMS versions prior to 1.28.4 Backdrop CMS versions 1.29.x prior to 1.29.2 Description: The issue allows for Cross Site Scripting XSS via an SVG document, if the SVG tag is allowed for a text format. This occurs in Backdrop CMS when a...

CVE-2024-36625

Zulip 8.3 is vulnerable to Cross Site Scripting XSS via the replaceemojiwithtext function in uiutil.ts...

Backdrop CMS 安全漏洞

Backdrop CMS is a content management system CMS from Backdrop CMS open source. A security vulnerability exists in Backdrop CMS version 1.28.X prior to 1.28.4 and version 1.29.X prior to 1.29.2, which stems from a text formatting that allows the use of SVG markup, which makes it vulnerable to...

CVE-2024-54123

Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format...

CVE-2024-11918

The Image Alt Text plugin for WordPress is vulnerable to unauthorized modification of data| due to a missing capability check on the iataddalttxtaction and iatupdatealttxtaction AJAX actions in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with...

CVE-2024-11918 Image Alt Text <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Image Alt Text Update

The Image Alt Text plugin for WordPress is vulnerable to unauthorized modification of data| due to a missing capability check on the iataddalttxtaction and iatupdatealttxtaction AJAX actions in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with...

CVE-2024-11918 Image Alt Text <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Image Alt Text Update

The Image Alt Text plugin for WordPress is vulnerable to unauthorized modification of data| due to a missing capability check on the iataddalttxtaction and iatupdatealttxtaction AJAX actions in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with...

CVE-2024-11918

The CVE-2024-11918 entry concerns the WordPress Image Alt Text plugin (versions

SUSE CVE-2024-36464

When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords...

PT-2024-17345 · WordPress · Image Alt Text

Name of the Vulnerable Software and Affected Versions: Image Alt Text plugin for WordPress versions up to and including 2.0.0 Description: The issue allows authenticated attackers with subscriber-level access and above to update the alt text on arbitrary images due to a missing capability check o...

WordPress plugin Image Alt Text 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exis...

WordPress Image Alt Text plugin <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Image Alt Text Update vulnerability

Missing Authorization to Authenticated Subscriber+ Image Alt Text Update vulnerability discovered by WordFence in WordPress Plugin Image Alt Text versions = 2.0.0...

CVE-2024-36464

When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords...

DEBIAN-CVE-2024-42332

The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attac...

UBUNTU-CVE-2024-42332

The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attac...

Malicious code in rtn-centered-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c2f20177c95333172f2abb0596c37a5b6c2a294dcd40dda5a0608b6f83778b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rnt-demo-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5cbbd919711d5470c4eb7a7d5cfd11afa42fb66153dd49e08acc164e467d1da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11080 Malicious code in rnt-demo-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5cbbd919711d5470c4eb7a7d5cfd11afa42fb66153dd49e08acc164e467d1da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rct-centered-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dc6a8e05244932d5a9c6a3e845c59c4313f962558c160bf03c579325473646d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...