CVE-2024-4615: Improper Neutralization of Input During Web Page Generation

The Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Horizontal Nav Menu' widget in all versions up to, and...

MAL-2024-1590 Malicious code in ing-feat-lu-luxtrust-smartcard-authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e101f8c803c8ca5e2fddab02abc82d9de8ce89fd23fb6f52bc2fd31a73c0fa01 The OpenSSF Package Analysis project identified 'ing-feat-lu-luxtrust-smartcard-authentication' @ 200.0.1 npm as malicious. It is considered...

MAL-2024-1566 Malicious code in ct-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e783edf3831848aac61070e6d4fcd03fb9023946d4c766f49e7d35b0403baa6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-34815: Missing Authorization

Missing Authorization vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through = 1.26.5...

MAL-2024-1561 Malicious code in rb-payment-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4eb4113e8b820d0f3ed35205bfc6b682ce6bb937db31002b79c44bb723908e18 The OpenSSF Package Analysis project identified 'rb-payment-wallet' @ 0.1.2 npm as malicious. It is considered malicious because: - The package...

CVE-2024-33565: Missing Authorization

Missing Authorization vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through 1.5.3...

MAL-2024-1557 Malicious code in glamorous-codemods (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1a6ea39de6911785f412a5a42905522010930dec6afece74458f8b4859a0fce5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1556 Malicious code in rey-vue-smarttable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 98a856f629a1b4854c5202dbdd7b0919ec1ad20cd28a8fa2b52591843913f112 The OpenSSF Package Analysis project identified 'rey-vue-smarttable' @ 19.19.19 npm as malicious. It is considered malicious because: - The...

Security Bulletin: IBM OpenPages is affected by multiple security vulnerabilities of DB2 Database Server (April 2024)

Summary IBM® Db2® Database Server is shipped as a supporting program of IBM OpenPages. Information about security vulnerabilities affecting IBM Db2 Database Server has been published in multiple security bulletins. Vulnerability Details Refer to the security bulletins listed in the...

CVE-2024-5001: Improper Neutralization of Input During Web Page Generation

The Image Hover Effects for Elementor with Lightbox and Flipbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id', 'oxiaddonsftitletag', and 'contentdescriptiontag' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and outpu...

DEBIAN-CVE-2024-5171

Integer overflow in libaom internal function imgallochelper can lead to heap buffer overflow. This function can be reached via 3 callers: Calling aomimgalloc with a large value of the dw, dh, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and so...

CVE-2024-35652: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Saso Nikolov Event Tickets with Ticket Scanner allows Reflected XSS.This issue affects Event Tickets with Ticket Scanner: from n/a through 2.3.1...

PT-2024-26598

Name of the Vulnerable Software and Affected Versions Event Tickets with Ticket Scanner versions 2.3.1 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendation...

CVE-2024-4057: Improper Neutralization of Input During Web Page Generation

The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.37 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripti...

PT-2024-12135

Name of the Vulnerable Software and Affected Versions CP Contact Form with Paypal versions 1.3.34 and earlier Description The issue is related to a Missing Authorization vulnerability in CP Contact Form with Paypal, which allows functionality misuse. Recommendations For versions 1.3.34 and earlie...

CVE-2023-27460: Missing Authorization

Missing Authorization vulnerability in CodePeople, paypaldev CP Contact Form with Paypal allows Functionality Misuse.This issue affects CP Contact Form with Paypal: from n/a through 1.3.34...

RHEL 4 : php (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - php: paths with NULL character were considered valid CVE-2006-7243 - php: XSLT file writing vulnerability...

UBUNTU-CVE-2024-36931

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Ensure the copied buf is NUL terminated Currently, we allocate a lbuf-sized kernel buffer and copy lbuf from userspace to that buffer. Later, we use scanf on this buffer but we don't ensure that the string is terminated...

MAL-2024-1390 Malicious code in hello-1st-anni (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7324e12f4247915474315b0c6446c86c97ef20bca17e3baa9b31478fc7e612d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-5207: Improper Neutralization of Special Elements used in an SQL Command

The POST SMTP – The 1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for WordPress is vulnerable to time-based SQL Injection via the selected parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied...