CVE-2024-54133

A cross site scripting XSS vulnerability was found in the contentsecuritypolicy helper in certain versions of Action Pack. Applications which set Content-Security-Policy CSP headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs injecting new directives into t...

CVE-2024-11724

The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker for GDPR, CCPA & ePrivacy plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wplscriptsave AJAX action in all versions up to, and including, 3.6.5...

CVE-2024-11724

The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker for GDPR, CCPA & ePrivacy plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wplscriptsave AJAX action in all versions up to, and including, 3.6.5...

PT-2024-17640 · WordPress · Arena.Im

Name of the Vulnerable Software and Affected Versions: Arena.IM – Live Blogging for real-time events plugin for WordPress versions up to, and including, 0.3.0 Description: The issue is due to missing or incorrect nonce validation on the albfre user action AJAX action. This allows unauthenticated...

WordPress plugin Arena.IM – Live Blogging for real-time events 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists in...

WordPress plugin Custom Skins Contact Form 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

CVE-2024-28141 Cross-Site Request-Forgery

The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the...

MAL-2024-11764 Malicious code in plugin-proposal-json-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c11469c014eaf5720410613f78c79dd6cd0aa28aca6fd52a0152441fb13b242e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-54133

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

DEBIAN-CVE-2024-54133

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

CVE-2024-54133

CVE-2024-54133 – Action Pack CSP bypass (XSS): Affected Rails Action Pack versions exposed a vulnerability in the content_security_policy helper that could allow untrusted input to inject new directives into CSP headers, bypassing CSP protections. The issue affects 5.2.0–7.0.8.6, 7.1.0–7.1.5.0, 7...

CVE-2024-54133 Possible Content Security Policy bypass in Action Dispatch

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

CVE-2024-54133 Possible Content Security Policy bypass in Action Dispatch

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

CVE-2024-54133 Possible Content Security Policy bypass in Action Dispatch

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

CVE-2024-54133

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

GHSA-VFM5-RMRH-J26V Possible Content Security Policy bypass in Action Dispatch

There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper in Action Pack. Impact ------ Applications which set Content-Security-Policy CSP headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new...

CVE-2024-49513

PDFL SDK versions 21.0.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2024-10959

CVE-2024-10959 details (Wordfence/Red Hat source): Affected software is the WordPress plugin Active Products Tables for WooCommerce. Use constructor to create tables . The vulnerability is an unauthenticated arbitrary shortcode execution via the woot_get_smth AJAX action, caused by executing do_s...

MAL-2024-11763 Malicious code in keypair-layout-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14dcde51dd210ea29065e53961174252e1e089b897e7470b76239c5b45799eff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-10400

Name of the Vulnerable Software and Affected Versions Action Pack versions 5.2.0 through 7.0.8.6 Action Pack versions 7.0.8.7 through 7.1.5.0 Action Pack versions 7.1.5.1 through 7.2.2.0 Action Pack versions 7.2.2.1 through 8.0.0.0 Description The issue is related to the content security policy...