WordPress Plugin "VK All in One Expansion Unit" vulnerable to cross-site scripting

Overview "Custom Alert Content" of WordPress Plugin "VK All in One Expansion Unit" provided by Vektor,Inc. contains a stored cross-site scripting vulnerability CWE-79. Umeda Yuugo of Tokyo Denki University reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

PT-2024-16790 · WordPress · Wordpress User Extra Fields

Name of the Vulnerable Software and Affected Versions: WordPress User Extra Fields plugin versions up to, and including, 16.6 Description: The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete tmp...

PT-2024-35375 · Jenkins · Jenkins Openid Connect Authentication Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OpenId Connect Authentication Plugin versions 4.418.vccc7061f5b 6d and earlier Description: The issue arises because the plugin does not invalidate the previous session on login, allowing attackers to potentially use social engineerin...

TIBCO Security Advisory: November 12, 2024 - TIBCO Hawk & Operational Intelligence - CVE-2024-10217

TIBCO Hawk Stored-XSS Vulnerability Original release date: November 12, 2024 Last revised: --- CVE-2024-10217 Source: TIBCO Software Inc. Products Affected TIBCO Hawk versions 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, and 6.3.0 TIBCO Operational Intelligence Hawk versions 7.2.0, 7.2.1, and 7.2.2 Compone...

PT-2024-8155 · Microsoft · 365 Apps For Enterprise +2

Name of the Vulnerable Software and Affected Versions: Microsoft Office versions affected versions not specified Microsoft Excel versions affected versions not specified Microsoft 365 Apps for Enterprise versions affected versions not specified Description: The issue is related to a buffer overfl...

Siemens SIMATIC CP

SUMMARY SIMATIC CP 1543-1 devices contain an Incorrect Authorization vulnerability that could allow an unauthenticated attacker to gain access to the filesystem. Siemens has released a new version for SIMATIC CP 1543-1 V4.0 and recommends to update to the latest version. 2. GENERAL...

PT-2024-8014 · Adobe · After Effects

Name of the Vulnerable Software and Affected Versions: Adobe After Effects versions 23.6.9, 24.6.2 and earlier Description: The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass...

Ubuntu 22.04 LTS : Linux kernel vulnerabilities (USN-7100-2)

"The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7100-2 advisory. Supraja Sridhara, Benedict Schlter, Mark Kuhne, Andrin Bertschi, and Shweta Shinde discovered that the Confidential Computing framework in the Linux...

Siemens Mendix Runtime

SUMMARY The basic authentication mechanism of Mendix Runtime contains a race condition vulnerability which could allow unauthenticated remote attackers to circumvent default account lockout measures. Siemens has released new versions for several affected products and recommends to update to the...

Siemens TeleControl Server

SUMMARY TeleControl Server Basic V3.1 contains a deserialization vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the device. Siemens has released new versions for the affected products and recommends to update to the latest versions. 2. GENERAL...

 Intel® Distribution for Python Software Advisory

Summary: A potential security vulnerability in some Intel® Distribution for Python software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2024-29083 Description: Incorrect default permissions in...

PT-2024-34964 · WordPress · Wp Contest

Name of the Vulnerable Software and Affected Versions: WP Contest versions n/a through 1.0.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection, potentially enabling...

PT-2024-34723 · Unknown · Clever Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Clever Addons for Elementor versions through 2.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS or Stored XSS. This allows for the storage of maliciou...

PT-2024-35193 · Unknown · Bu Slideshow

Name of the Vulnerable Software and Affected Versions: BU Slideshow versions n/a through 2.3.10 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. Specifically, it is a Stored XSS vulnerability in the BU...

PT-2024-34717 · Unknown · Simple Goods

Name of the Vulnerable Software and Affected Versions: Simple Goods versions 0.1.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in Simple Goods. Recommendations: For...

PT-2024-35199 · Unknown · Liquid Blocks

Name of the Vulnerable Software and Affected Versions: LIQUID BLOCKS versions 1.2.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For versio...

PT-2024-34740 · Unknown · Themeshark Templates & Widgets For Elementor

Name of the Vulnerable Software and Affected Versions: ThemeShark Templates & Widgets for Elementor versions 1.1.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS, wher...

PT-2024-34908 · Sanjaysolutions · Sanjaysolutions Loginplus

Name of the Vulnerable Software and Affected Versions: Sanjaysolutions Loginplus versions 1.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations:...

PT-2024-16386 · WordPress · Debug Tool

Name of the Vulnerable Software and Affected Versions: Debug Tool plugin for WordPress versions up to, and including, 2.2 Description: The issue is related to a missing capability check on the info function, allowing authenticated attackers with subscriber-level access and above to obtain...

PT-2024-16469 · Unknown +1 · Skt Addons For Elementor +1

Name of the Vulnerable Software and Affected Versions: SKT Addons for Elementor versions up to, and including, 3.3 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from private or draft posts created by Elementor that they should not ha...