CVE-2024-35751

Technical details for CVE-2024-35751 ( Woody code snippets plugin, affected version range, XSS impact, and fixes) are not provided in the supplied Connected Documents. Monitor for updates.

WordPress plugin Woody ad snippets cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-26705 · Unknown · Woody Ad Snippets

Name of the Vulnerable Software and Affected Versions: Woody ad snippets versions n/a through 2.4.10 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. No information is...

WordPress Woody ad snippets Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)

Software Woody ad snippets Type Plugin Vulnerable versions = 2.5.0 Fixed in 2.5.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35751 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID fea34aee9079 Credits savphill Required privilege...

Malicious code in @juiggitea/vel-ad-ut (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7139bc201f51d17b197242d76fbc388aba5b238053c72cb427cbc25d605a85e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1496 Malicious code in @juiggitea/vel-ad-ut (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7139bc201f51d17b197242d76fbc388aba5b238053c72cb427cbc25d605a85e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AdFoxly – Ad Manager, AdSense Ads & Ads.txt <= 1.8.5 - Missing Authorization

Description The AdFoxly – Ad Manager, AdSense Ads & Ads.txt plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to perform an unauthorized action...

Exposure Of Sensitive Information To An Unauthorized Actor

Mattermost is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability is due to a lack of proper authorization checks in the /api/v4/groups//channels//link endpoint, allowing users to learn members of an AD/LDAP group linked to a team by adding the group to a...

Mattermost Server Security Bypass Vulnerability

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security bypass vulnerability exists in Mattermost Server, which can be exploited by an attacker to bypass access restrictions and learn about the members of an AD/LDAP group linked to a team by...

Oracle Linux 8 : openssh (ELSA-2024-3166)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3166 advisory. - Providing a kill switch for scp to deal with CVE-2020-15778 Resolves: RHEL-22870 Tenable has extracted the preceding description block directly from the Oracl...

CVE-2024-34029

Mattermost versions 9.5.x /channels//link endpoint which allows a user to learn the members of an AD/LDAP group that is linked to a team by adding the group to a channel, even if the user has no access to the team...

CVE-2024-34029 AD/LDAP Group Members Leak

Mattermost versions 9.5.x /channels//link endpoint which allows a user to learn the members of an AD/LDAP group that is linked to a team by adding the group to a channel, even if the user has no access to the team...

CVE-2024-34029

Mattermost suffers an authorization bypass in /api/v4/groups//channels//link, allowing a user to learn members of an AD/LDAP group linked to a team without having access to that team. Affected are Mattermost Server/Mattermost releases: 9.5.x up to 9.5.3, 9.7.x up to 9.7.1, and 8.1.x up to 8.1.12....

CVE-2024-4706

The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode in all versions up to, and including, 27.2 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2024-4706 WordPress + Microsoft Office 365 / Azure AD | LOGIN <= 27.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via pintra Shortcode

The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode in all versions up to, and including, 27.2 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2024-4706

CVE-2024-4706 affects WordPress + Microsoft Office 365 / Azure AD | LOGIN (wpo365-login). It enables Stored XSS via the pintra shortcode in all versions up to 27.2 due to insufficient input sanitization and output escaping on user-supplied attributes. An authenticated attacker with contributor+ a...

CVE-2024-4706 WordPress + Microsoft Office 365 / Azure AD | LOGIN <= 27.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via pintra Shortcode

The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode in all versions up to, and including, 27.2 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

WordPress + Microsoft Office 365 / Azure AD | LOGIN < 28.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via pintra Shortcode

Description The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode in all versions up to, and including, 27.2 due to insufficient input sanitization and output escaping on user supplied...

WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt Plugin <= 1.8.5 is vulnerable to Broken Access Control

Software AdFoxly – Ad Manager, AdSense Ads & Ads.txt Type Plugin Vulnerable versions = 1.8.5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-34802 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID ce75fd580f25 Credits...

Metasploit Wrap-Up 05/17/2024

LDAP Authentication Improvements This week, in Metasploit v6.4.9, the team has added multiple improvements for LDAP related attacks. Two improvements relating to authentication is the new support for Signing and Channel Binding. Microsoft has been making changes to harden the communications to...