SUSE CVE-2024-51749

Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attachments, stickers and images are coherent. It is possible to add thumbnails to events trigger a file download once clicked. Fixed in...

FreeBSD : element-web -- several vulnerabilities (ab4e6f65-a142-11ef-84e9-901b0e9408dc)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ab4e6f65-a142-11ef-84e9-901b0e9408dc advisory. Element team reports: Versions of Element Web and Desktop earlier than 1.11.85 do not check if...

Element 安全漏洞

Element is a Matrix web collaboration client from Element Open Source. A security vulnerability exists in Element versions prior to 1.11.85, which stems from a failure to check the consistency of thumbnails for attachments, stickers, and images...

PT-2024-34880 · Element · Element Desktop +1

Name of the Vulnerable Software and Affected Versions: Element Web and Desktop versions prior to 1.11.85 Description: The issue concerns the handling of thumbnails for attachments, stickers, and images. Specifically, versions of Element Web and Desktop earlier than 1.11.85 do not check if these...

CVE-2024-10535

The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeunusedthumbnails function in all versions up to, and including, 1.31. This makes it possible for unauthenticated attackers to delete thumbnails ...

CVE-2024-10535: Missing Authorization

The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeunusedthumbnails function in all versions up to, and including, 1.31. This makes it possible for unauthenticated attackers to delete thumbnails ...

PT-2024-16352 · WordPress · Video Gallery For Woocommerce

Name of the Vulnerable Software and Affected Versions: Video Gallery for WooCommerce plugin for WordPress versions up to, and including, 1.31 Description: The issue is related to a missing capability check on the remove unused thumbnails function, allowing unauthenticated attackers to delete...

CVE-2024-38719

Missing Authorization vulnerability in Creative Motion Auto Featured Image Auto Post Thumbnail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Featured Image Auto Post Thumbnail: from n/a through 4.1.2...

CVE-2024-38719: Missing Authorization

Missing Authorization vulnerability in Creative Motion Auto Featured Image Auto Post Thumbnail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Featured Image Auto Post Thumbnail: from n/a through 4.1.2...

WordPress plugin Auto Featured Image (Auto Post Thumbnail) 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...

CVE-2024-8737

The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-8737

The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-8737 PDF Thumbnail Generator <= 1.3 - Reflected Cross-Site Scripting

The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-8737 PDF Thumbnail Generator <= 1.3 - Reflected Cross-Site Scripting

The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

WordPress PDF Thumbnail Generator plugin <= 1.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin PDF Thumbnail Generator versions = 1.3...

WordPress plugin PDF Thumbnail Generator 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plug-in. A cross-site scripting...

WordPress PDF Thumbnail Generator Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)

Software PDF Thumbnail Generator Type Plugin Vulnerable versions = 1.3 Fixed in 1.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8737 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8724205bb063 Credits vgo0 Required...

PT-2024-39214 · WordPress · Pdf Thumbnail Generator

Name of the Vulnerable Software and Affected Versions: PDF Thumbnail Generator plugin for WordPress versions up to, and including, 1.3 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This allows...

CVE-2024-8737: Improper Neutralization of Input During Web Page Generation

The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-43921

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Magic Post Thumbnail allows Reflected XSS.This issue affects Magic Post Thumbnail: from n/a through 5.2.9...