WordPress plugin Sina Extension security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

SkillTree Security Vulnerabilities

SkillTree is a micro-learning gamification platform open-sourced by the National Security Agency. Provides out-of-the-box UI visualization, a convenient client integration library, and a dashboard for managing the creation and management of gamified training profiles. A security vulnerability...

PT-2024-35396 · Unknown · Sina Extension For Elementor

Name of the Vulnerable Software and Affected Versions: Sina Extension for Elementor versions up to, and including, 3.5.5 Description: The issue is related to Stored Cross-Site Scripting via the read more text parameter due to insufficient input sanitization and output escaping. This allows...

MAL-2024-10172 Malicious code in text-adventure-game (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d130695c8c001b5c9dcdb269da4709b4b1d6f75407f319a7ed709f2370212fdd --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: text-adventure-game-ch-2024-07 Reasons based on the campaign:...

Malicious code in text-adventure-game (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d130695c8c001b5c9dcdb269da4709b4b1d6f75407f319a7ed709f2370212fdd --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: text-adventure-game-ch-2024-07 Reasons based on the campaign:...

CVE-2024-37145 GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/id

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the /api/v1/chatflows-streaming/id endpoint. If the default configuration is used unauthenticated, an attacker may be able...

CVE-2024-36422 GHSL-2023-245: Flowise xss in api/v1/chatflows/id

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the api/v1/chatflows/id endpoint. If the default configuration is used unauthenticated, an attacker may be able to craft a...

GNU Emacs, Org Mode: Multiple Vulnerabilities

Background GNU Emacs is a highly extensible and customizable text editor. Description Multiple vulnerabilities have been discovered in GNU Emacs. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no...

ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow related to the snippet feature.

...

SQLite before 3.25.3 when the FTS3 extension is enabled encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases) aka Magellan.

...

GO-2024-2932 Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec in github.com/rancher/rancher

Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fro...

[SECURITY] Fedora 40 Update: emacs-29.4-3.fc40

Emacs is a powerful, customizable, self-documenting, modeless text editor. Emacs contains special code editing features, a scripting language elisp, and the capability to read mail, news, and more without leaving the editor. This package provides an emacs binary with support for Wayland, using th...

Information Disclosure

typo3/cms is vulnerable to Information Disclosure. The vulnerability is due to logging login failures, including plain-text user credentials, at the "warning" log level, which potentially leads to unauthorized access to sensitive user information...

PT-2024-6690 · Advantech · Adam-5630

Name of the Vulnerable Software and Affected Versions: Advantech ADAM-5630 affected versions not specified Description: The issue is related to the transmission of user credentials in plain text between the device and the user source device during the login process. This is due to the use of weak...

Malicious code in requirmentstxtt (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4976 Malicious code in colors-text (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in colors-text (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3118 Malicious code in @harrysforge-ui/text (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @harrysforge-ui/text (npm)

--- -= Per source details. Do not edit below this line.=-...

EulerOS 2.0 SP11 : ruby (EulerOS-SA-2024-1825)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do syst...