PT-2023-26192 · Jenkins · Jenkins Datadog Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Datadog Plugin versions 5.4.1 and earlier Description: A missing permission check in the Jenkins Datadog Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials...

Atlassian Jira Service Management 5.5.0 < 5.3.3 Critical Authentication Vulnerability

According to its self-reported version number, the Atlassian Jira Service Management application running on the remote host is version 5.3.0 prior to version 5.3.3, 5.4.0 prior to 5.4.2 or 5.5.0 prior to 5.3.3. It is, therefore, affected by a critical authentication vulnerability which allows a...

PT-2023-21368 · Prestashop · Prestashop Askforaquote

Name of the Vulnerable Software and Affected Versions: PrestaShop askforaquote versions 5.4.2 and earlier Description: A SQL injection issue allows a remote attacker to gain privileges via the QuotesProduct::deleteProduct component. This enables the attacker to potentially access and manipulate...

TIBCO Security Advisory: September 21, 2022 - TIBCO EBX Add-ons -CVE-2022-30578

TIBCO EBX Add-ons Stored XSS vulnerability Original release date: September 21, 2022 Lastrevised: --- CVE-2022-30578 Source: TIBCOSoftware Inc. Products Affected TIBCO EBX Add-ons versions 5.4.1 and below The following component is affected: Web Server Description The component listed above...

CVE-2020-4047

In affected versions of WordPress, authenticated users with upload permissions like authors are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has...

Fedora 32 : wordpress (2020-8447a3e195)

WordPress 5.4.2 Security and Maintenance Release This security and maintenance release features 23 fixes and enhancements. Plus, it adds a number of security fixessee the list below. These bugs affect WordPress versions 5.4.1 and earlier; version 5.4.2 fixes them, so youll want to upgrade. Securi...

WordPress < 5.4.2

According to its self-reported version number, the installation of WordPress installed on the remote host is affected by multiple vulnerabilities: - Multiple cross-site scripting XSS vulnerabilities exist in Wordpress due to improper validation of user-supplied input before returning it to users...

CVE-2020-4046

In affected versions of WordPress, users with low privileges like contributors and authors can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin...

CVE-2020-4050

In affected versions of WordPress, misuse of the set-screen-option filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in...

CVE-2020-4049

In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version...

DEBIAN-CVE-2020-4049

In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version...

DEBIAN-CVE-2020-4046

In affected versions of WordPress, users with low privileges like contributors and authors can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin...

Design/Logic Flaw

In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version...

Open redirect

In affected versions of WordPress, due to an issue in wpvalidateredirect and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release...

UBUNTU-CVE-2020-4049

In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version...

CVE-2020-4048

In affected versions of WordPress, due to an issue in wpvalidateredirect and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release...

CVE-2020-4050

CVE-2020-4050 (WordPress) is a vulnerability where misusing the set-screen-option filter’s return value can enable arbitrary user meta fields to be saved. It requires an admin to install a plugin that misuses the filter, after which low-privilege users may exploit it. The issue was fixed in WordP...

CVE-2020-4046 Authenticated XSS through embed block in WordPress

In affected versions of WordPress, users with low privileges like contributors and authors can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin...

CVE-2019-19767

The Linux kernel before 5.4.2 mishandles ext4expandextraisize, as demonstrated by use-after-free errors in ext4expandextraisize and ext4xattrsetentry, related to fs/ext4/inode.c and fs/ext4/super.c, aka CID-4ea99936a163...

CVE-2018-16146

The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated administrator to test notifications that are triggered under certain configurable events. The value parameter is not properly sanitized, leading to arbitrary command injection wi...