SUSE-SU-2025:20035-1 Security update for python-Jinja2

This update for python-Jinja2 fixes the following issues: - CVE-2024-34064, CVE-2024-22195: HTML attribute injection when passing user input as keys to xmlattr filter bsc1223980, bsc1218722...

CVE-2024-10395 net: lib: http_server: Buffer Under-read

No proper validation of the length of user input in httpservergetcontenttypefromextension...

CVE-2024-10395

CVE-2024-10395 affects Zephyr RTOS components (notably the http_server code path handling content-type inference) due to missing validation of input length in http_server_get_content_type_from_extension. Multiple connected sources describe a Buffer Under-read rooted in insufficient length checks,...

PT-2025-5496 · WordPress · Custom Wp Store Locator

Name of the Vulnerable Software and Affected Versions: Custom WP Store Locator versions 1.4.7 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting XSS. This enables attackers to inject malicio...

PT-2025-4627 · WordPress · Wp Travel

Name of the Vulnerable Software and Affected Versions: WP Travel versions prior to 10.1.0 Description: The issue is related to improper neutralization of special elements used in an SQL command, which allows SQL injection. This means that an attacker could potentially inject malicious SQL code to...

ROS-20250203-15

Vulnerability in Active Support PostgreSQL component of Ruby interpreter is related to insufficient validation of user input in Active Support in Inflector.underscore. user input data in Active Support in Inflector.underscore. Exploitation of the vulnerability could allow an attacker acting...

ROS-20250203-14

A vulnerability in the Action Dispatch component of the Ruby on Rails software platform is related to insufficient validation of user input in Action Dispatch. insufficient validation of user input data in Action Dispatch. Exploitation of the vulnerability could allow an attacker acting remotely ...

PT-2025-5606 · Rengine · Rengine

Name of the Vulnerable Software and Affected Versions: reNgine affected versions not specified Description: The issue allows a user to inject commands via the nmap cmd parameters. This is a command injection issue in the reNgine automated reconnaissance framework for web applications. Users are...

PT-2025-3400 · Classcms · Classcms

Name of the Vulnerable Software and Affected Versions: ClassCMS version 4.8 Description: The issue is related to Cross Site Scripting XSS in the class/admin/channel.php file. This allows for potential malicious script injection. Recommendations: For ClassCMS version 4.8, consider restricting acce...

CVE-2024-13612

The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bettermessageslivechatbutton' shortcode in all versions up to, and including, 2.6.9 due to insufficient input...

CVE-2024-13612

CVE-2024-13612 (Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss) is an authenticated Stored Cross-Site Scripting (XSS) vulnerability via the plugin shortcodes/better_messages_live_chat_button, affecting all versions up to 2.6.9. Exploitation requires cont...

ASB-A-364037868

In transferTouchGesture of WindowManagerService.java , there is a possible way to steal sensitive user input due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-13662

The eHive Objects Image Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ehiveobjectsimagegrid' shortcode in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2025-5463 · Paytm · Paytm Payment Donation

Name of the Vulnerable Software and Affected Versions: Paytm Payment Donation versions n/a through 2.3.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions n/a...

CVE-2025-24504

An improper input validation the CSRF filter results in unsanitized user input written to the application logs...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for Jan 2025

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Process Mining 2.0.0 IF001 Vulnerability Details CVEID:CVE-2024-43796 DESCRIPTION: expressjs express is vulnerable to cross-site scripting, caused by improper...

CVE-2024-13700 Embed Swagger UI <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Embed Swagger UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsgui' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13700 Embed Swagger UI <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Embed Swagger UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsgui' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13380 Alex Reservations: Smart Restaurant Booking <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rrform' shortcode in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-13466

The CVE CVE-2024-13466 affects the WordPress plugin Automatically Hierarchic Categories in Menu (versions up to 2.0.7). It exposes a Stored Cross-Site Scripting (XSS) vulnerability via the autocategorymenu shortcode due to insufficient input sanitization and output escaping, enabling authenticate...