855 matches found
CVE-2024-37732
Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file...
Anchor Cross-Site Scripting Vulnerability
Anchor is an open source lightweight blogging system. A cross-site scripting vulnerability exists in Anchor version v.0.12.7, which originates from a vulnerability that could allow a remote attacker to execute arbitrary code via a crafted .pdf file...
CVE-2024-37732
Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file...
CVE-2024-37732
CVE-2024-37732 affects Anchor CMS v0.12.7. The vulnerability is described as a Cross-Site Scripting issue that allows a remote attacker to execute arbitrary code via a crafted .pdf file. All provided sources (NVD, Red Hat, OSV, CVE list, CNNVD, etc.) consistently cite the same description, confir...
CVE-2024-37732
Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file...
CVE-2024-37732
Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file...
PT-2024-27725 · Unknown · Anchor Cms
Name of the Vulnerable Software and Affected Versions: Anchor CMS version 0.12.7 Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via a crafted .pdf file. Recommendations: For Anchor CMS version 0.12.7, update to a version that fixes this issue, as usin...
WordPress plugin Ultimate Blocks security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2024-610)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-610 advisory. An issue was discovered in some DNS recursive resolvers that allows remote attackers to cause a denial of service using a maliciously designed authority and response amplification. CVE-2024-33655 Tenabl...
Vditor 跨站脚本漏洞
Vditor is a browser-side Markdown editor by the individual developer Vanessa219. A cross-site scripting vulnerability exists in Vditor version 3.10.3, which originates from allowing cross-site scripting attacks via attributes of A element...
PT-2024-25903 · Vditor · Vditor
Name of the Vulnerable Software and Affected Versions: Vditor version 3.10.3 Description: The issue allows XSS via an attribute of an A element. The vendor indicates that a user is supposed to mitigate this via sanitize=true. Recommendations: For Vditor version 3.10.3, to mitigate the issue, set...
CVE-2024-34449
Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true...
shim: Out-of-bound read in verify_buffer_sbat()
An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase...
GHSA-G7XQ-XV8C-H98C Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags
Summary There is a potential cross-site scripting XSS vulnerability that can be exploited via maliciously crafted user data. Our filter to detect and prevent the use of the javascript: URL scheme in the href attribute of an tag could be bypassed with tab \t or newline \n characters between the...
X.com Automatically Changing Link Text but Not URLs
Brian Krebs reported that X formerly known as Twitter started automatically changing twitter.com links to x.com links. The problem is: 1 it changed any domain name that ended with "twitter.com," and 2 it only changed the links appearance anchortext, not the underlying URL. So if you were a clever...
Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags
Summary There is a potential cross-site scripting XSS vulnerability that can be exploited via maliciously crafted user data. Our filter to detect and prevent the use of the javascript: URL scheme in the href attribute of an tag could be bypassed with tab \t or newline \n characters between the...
PT-2024-18487 · Kadence Blocks · The Gutenberg Blocks By Kadence Blocks
Name of the Vulnerable Software and Affected Versions: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress versions prior to 3.2.26 Description: The issue is related to Stored Cross-Site Scripting via the Testimonial Widget's anchor style parameter due to...
Cross-Site Request Forgery (CSRF)
anchorcms/anchor-cms is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to improper request validation, which allows an attacker to forge requests and execute unauthorized actions on behalf of authenticated users...