2992 matches found
CVE-2024-0438: Improper Neutralization of Input During Web Page Generation
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wrapper link parameter in the Age Gate in all versions up to, and including, 3.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke...
PT-2024-9841 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a potential buffer overflow in the map hw resources function. The function was accessing arrays using an index that could potentially be greater than the size o...
PT-2024-15562 · WordPress · Happy Addons For Elementor
Name of the Vulnerable Software and Affected Versions: The Happy Addons for Elementor plugin for WordPress versions up to, and including, 3.10.1 Description: The issue is related to Stored Cross-Site Scripting via the wrapper link parameter in the Age Gate due to insufficient input sanitization a...
com.erudika:para-server (1.22.0), org.id4me:aim-api-wrapper (>=1.0, <=2.0) +7 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (4.33)
com.nimbusds:nimbus-jose-jwt MAVEN version 4.33 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.erudika:para-server 1.22.0 - org.id4me:aim-api-wrapper =1.0, =1.0, =1.3.0-rc1, =1.3.0-rc1, =1.3.0-rc...
pl.coderion:openfoodfacts-java-wrapper (0.9.3) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (2.5.5)
io.micronaut:micronaut-http-server-netty MAVEN version 2.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - pl.coderion:openfoodfacts-java-wrapper 0.9.3 Source cves: CVE-2024-23639 Source...
autotrain-advanced (>=0.6.14, <=0.6.15.dev0), llama2-wrapper (>=0.1.0, <=0.1.14) potentially affected by CVE-2024-0964 via gradio (3.37.0)
gradio PYPI version 3.37.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - autotrain-advanced =0.6.14, =0.1.0, =0.1.14 Source cves: CVE-2024-0964 Source advisory: OSV:GHSA-F3H9-8PHC-6GVH...
WordPress Shariff Wrapper Plugin < 4.6.10 is vulnerable to Cross Site Scripting (XSS)
Software Shariff Wrapper Type Plugin Vulnerable versions 4.6.10 Fixed in 4.6.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1106 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID da44df395b73 Credits Dmitrii Ignatyev Require...
CVE-2024-0954
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting through editing context via the 'data-eael-wrapper-link' wrapper in all versions up to, and including, 5.9.7 due to insufficient...
PT-2024-15934 · WordPress · Essential Addons For Elementor
Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 5.9.7 Description: The issue is related to Stored Cross-Site Scripting, which occurs due to insufficient input sanitization and output escaping on...
CVE-2024-0954: Improper Neutralization of Input During Web Page Generation
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting through editing context via the 'data-eael-wrapper-link' wrapper in all versions up to, and including, 5.9.7 due to insufficient...
Shariff Wrapper < 4.6.10 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Put the following payload in the...
Shariff Wrapper < 4.6.10 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Put the following payload in the...
Exploit for PHP External Variable Modification in Juniper Junos
CVE-2023-36845 Description CVE-2023-36845 represen...
RHEL 8 : open-vm-tools (RHSA-2023:7264)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7264 advisory. The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualizati...
CloudLinux CageFS 7.1.1-1 Token Disclosure
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CloudLinux CageFS Token Disclosure Link: https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-01CloudLinuxCageFSTokenDisclosure Vulnerability Overview CloudLinux CageFS 7.1.1-1 or below passes the authentication token as a...
Traceroute 2.1.2 Privilege Escalation Vulnerability
In Traceroute versions 2.0.12 through to 2.1.2, the wrapper scripts mishandle shell metacharacters, which can lead to privilege escalation if the wrapper scripts are executed via sudo. The affected wrapper scripts include tcptraceroute, tracepath, traceproto, and traceroute-nanog. Version 2.1.3...
Traceroute 2.1.2 Privilege Escalation
Description: In Traceroute 2.0.12 through to 2.1.2 fixed in 2.1.3, the wrapper scripts mishandle shell metacharacters, which can lead to privilege escalation if the wrapper scripts are executed via sudo. The affected wrapper scripts are: tcptraceroute, tracepath, traceproto and traceroute-nanog...
EulerOS Virtualization 2.9.1 : traceroute (EulerOS-SA-2024-1049)
According to the versions of the traceroute package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines. CVE-2023-46316...
Python’s Poisoned Package: Another ‘Blank Grabber’ Malware in PyPI
Python Package Index PyPI is a platform that offers an extensive range of packages to simplify and enhance the development process. Malicious actors regularly upload phishing packages in the platform’s repository aimed at delivering malware to steal the victims information, or more frequently, to...
