WordPress plugin WP Travel Engine 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2023-39995

Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Portfolio and Projects portfolio-and-projects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio and Projects: from n/a through = 1.3.7...

CVE-2023-39995

CVE-2023-39995 relates to WordPress Portfolio and Projects plugin (versions

WordPress plugin Portfolio and Projects 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-12828 · Unknown +1 · Essential Plugin Portfolio/Projects +2

Name of the Vulnerable Software and Affected Versions: WP OnlineSupport, Essential Plugin Portfolio and Projects versions 1.3.7 and earlier Description: The issue affects the Portfolio and Projects plugin for WordPress, involving broken access control due to missing authorization. This allows for...

CVE-2024-48651

In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from modsql...

WordPress StreamWeasels YouTube Integration Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)

Software StreamWeasels YouTube Integration Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11788 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bbd6037644c5 Credits...

MAL-2024-10734 Malicious code in @freshworksinc/haxer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis de5ef35194af0d5cbffe32f426bd864775477d0ad6d618c146e07b2f974b577d The OpenSSF Package Analysis project identified '@freshworksinc/haxer' @ 1.3.7 npm as malicious. It is considered malicious because: - The packa...

CVE-2024-9068

The OneElements – Best Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2024-39403 · WordPress · The Oneelements – Best Elementor Addons

Name of the Vulnerable Software and Affected Versions: The OneElements – Best Elementor Addons plugin for WordPress versions up to, and including, 1.3.7 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping...

Security Bulletin: Vulnerabilities in Apache Ant affect IBM Operations Analytics - Log Analysis (CVE-2020-11023, CVE-2020-23064, CVE-2020-11022)

Summary There are multple cross site scripting vulnerabilities in Apache Ant that effect IBM Operations Analytics - Log Analysis. These have been addressed. Vulnerability Details CVEID:CVE-2020-11023 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of...

WordPress YayExtra plugin <= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file Function vulnerability

Unauthenticated Arbitrary File Upload via handleuploadfile Function vulnerability discovered by wesley wcraft in WordPress Plugin YayExtra versions = 1.3.7...

MAL-2024-7833 Malicious code in noc-chatbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 404db7a5f4f99325b3d619a50290cc88ef3bdd8cc789301a4d3c54c655a20418 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-27635 · Unknown · Uusweb.Ee Ws Contact Form

Name of the Vulnerable Software and Affected Versions: UusWeb.Ee WS Contact Form versions 1.3.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations...

WordPress i-amaze theme <= 1.3.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme i-amaze versions = 1.3.7...

WordPress WS Contact Form Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)

Software WS Contact Form Type Plugin Vulnerable versions = 1.3.7 Fixed in 1.3.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37537 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9166c1a50a0c Credits younsoung kim, SeoHyeon Lee, MyungJu...

WordPress Metro Magazine theme <= 1.3.7 - Broken Access Control on Notice Dismissal vulnerability

Broken Access Control on Notice Dismissal vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Metro Magazine versions = 1.3.7...

PT-2024-25580 · Unknown · Tweetscroll Widget

Name of the Vulnerable Software and Affected Versions: TweetScroll Widget versions 1.3.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in the TweetScroll Widget...

WordPress plugin TweetScroll Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Pearl Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)

Software Pearl Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4000 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 24b9141edb4a Credits Krzysztof Zając Required privilege...