WordPress Plugin Quiz and Survey Master Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Quiz and Survey Master security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

PT-2024-28043 · Nextchat · Nextchat

Name of the Vulnerable Software and Affected Versions: NextChat versions prior to 2.12.4 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability. This is due to a lack of validation of the endpoint GET parameter on the "WebDav API endpoint". The SSRF can be used to...

PYSEC-2024-318

A Regular Expression Denial of Service ReDoS vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability is located in the filterhistory function within the utils.py module. This function takes a user-provided keyword and attempts to match it against chat history...

CVE-2024-3111

The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues...

Elektraweb Security Vulnerabilities

Elektraweb is a cloud-hosted web-based hotel program from Elektraweb, Turkey. A security vulnerability exists in Elektraweb versions prior to v17.0.68, which stems from reliance on unvalidated and integrity-checked cookies, which allows an attacker to manipulate, access/intercept/modify HTTP...

CVE-2024-5199

The Spotify Play Button WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Important: Red Hat Security Advisory: Release of OpenShift Serverless Logic 1.33.0 security update & enhancements

Release of OpenShift Serverless Logic 1.33.0 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

WordPress plugin Responsive video embed security vulnerability

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Custom Field Suite plugin is a custom field adding plugin used in it.Media Library...

PT-2024-30272 · Unknown · Post Grid Gutenberg Blocks/Wordpress Blog Plugin

Name of the Vulnerable Software and Affected Versions: The Post Grid Gutenberg Blocks and WordPress Blog Plugin version prior to 4.1.0 Description: The issue concerns a lack of validation and escaping of certain block options, which could allow users with the contributor role and above to perform...

CVE-2024-3978

The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting atta...

Rocky Linux 8 : squashfs-tools (RLSA-2024:3139)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:3139 advisory. squashfs-tools: unvalidated filepaths allow writing outside of destination CVE-2021-40153 squashfs-tools: possible Directory Traversal via symbolic link...

CVE-2024-3032

Themify Builder WordPress plugin before 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue...

WordPress plugin Themify Builder security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

SUSE CVE-2023-4458

A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on...

PT-2024-7841 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions 10.9.1 through 11.0 Description: The issue is related to an unvalidated redirect vulnerability that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary...

ghtml Cross-Site Scripting Vulnerability

ghtml is a toolkit by the individual developer Gürgün Dayıoğlu. A cross-site scripting vulnerability exists in ghtml versions prior to 2.0.0, which stems from unprocessed attribute value encoding and lack of control over href values, and could lead to cross-site scripting...

PT-2024-24935 · WordPress · Logo Slider

Name of the Vulnerable Software and Affected Versions: The Logo Slider WordPress plugin versions prior to 4.0.0 Description: The issue concerns the lack of validation and escaping of certain Slider Settings in the plugin, which could allow users with the contributor role and above to perform Stor...

UBUNTU-CVE-2024-5480

A vulnerability in the PyTorch's torch.distributed.rpc framework, specifically in versions prior to 2.2.2, allows for remote code execution RCE. The framework, which is used in distributed training scenarios, does not properly verify the functions being called during RPC Remote Procedure Call...

CVE-2024-5225 SQL Injection in berriai/litellm

An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the /global/spend/logs endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidat...