SUSE CVE-2024-9958

Inappropriate implementation in PictureInPicture in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2024-9961

Use after free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2024-9962

Inappropriate implementation in Permissions in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2024-9963

Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2024-9964

Inappropriate implementation in Payments in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...

SUSE CVE-2024-9965

Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. Chromium security severity: Low...

WordPress Flat UI Button Plugin 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Flat UI Button Type Plugin Vulnerable versions 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10014 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 35d97ede67c1 Credits Francesco Carlucci Required...

CVE-2024-30875

CVE-2024-30875 affects jquery-ui v1.13.1 with a Cross-Site Scripting (XSS) vulnerability via the window.addEventListener component. IBM’s bulletin confirms the issue and lists affected IBM Robotic Process Automation products, with remediation paths to update to 21.0.7.19+ or 23.0.20+ (Cloud Pak a...

IBM WebSphere Application Server Cross-Site Scripting Vulnerability (CNVD-2024-43188)

IBM WebSphere Application Server WAS is an application server product from International Business Machines IBM. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. A cross-site scripting vulnerability exists in IBM...

Unspecified Vulnerability in Google Chrome (CNVD-2024-44479)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome prior to version 130.0.6723.58, which stems from an improper implementation of PictureInPicture, and can be exploited by remote attackers to perform UI spoofing via a crafted HTML pag...

CVE-2024-30875

Cross Site Scripting vulnerability in JavaScript Library jquery-ui v.1.13.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the window.addEventListener component. NOTE: this is disputed by the Supplier because it cannot be reproduced, a...

jQuery UI 安全漏洞

jQuery UI is a jQuery open source set of carefully curated user interface interactions, effects, widgets and themes built on jQuery. A security vulnerability exists in jQuery UI version v.1.13.1, which stems from the presence of a cross-site scripting vulnerability that allows remote attackers to...

Unspecified Vulnerability in Google Chrome (CNVD-2024-41034)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome prior to version 130.0.6723.58, which stems from the presence of post-release reuse, and can be exploited by a remote attacker to convince a user to perform a specific UI gesture,...

CVE-2024-30875

Cross Site Scripting vulnerability in JavaScript Library jquery-ui v.1.13.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the window.addEventListener component. NOTE: this is disputed by the Supplier because it cannot be reproduced, a...

Unspecified Vulnerability in Google Chrome (CNVD-2024-44484)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in versions prior to Google Chrome 130.0.6723.58, which can be exploited by remote attackers to perform UI spoofing via a crafted HTML page...

Unspecified Vulnerability in Google Chrome (CNVD-2024-44483)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in versions prior to Google Chrome 130.0.6723.58, which can be exploited by remote attackers to perform UI spoofing via a crafted HTML page...

Unspecified Vulnerability in Google Chrome (CNVD-2024-44485)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in versions prior to Google Chrome 130.0.6723.58, which can be exploited by remote attackers to perform UI spoofing via a crafted Chrome extension...

Microsoft Edge (Chromium) < 130.0.2849.46 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 130.0.2849.46. It is, therefore, affected by multiple vulnerabilities as referenced in the October 17, 2024 advisory. - Microsoft Edge Chromium-based Remote Code Execution Vulnerability CVE-2024-43566, CVE-2024-43578,...

CVE-2024-45071

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2024-45071 IBM WebSphere Application Server cross-site scripting

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...