WordPress Animated AL List Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Animated AL List Type Plugin Vulnerable versions = 1.0.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5728 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 61cefdad5337 Credits Bob Matyas Required...

CVE-2024-5728 Animated AL List <= 1.0.6 - Reflected XSS

The Animated AL List WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-5728

CVE-2024-5728 affects the Animated AL List WordPress plugin up to version 1.0.6. The vulnerability is a Reflected Cross-Site Scripting (XSS) caused by the plugin not sanitising and escaping an input parameter before echoing it back in the page. This could be exploited against high-privilege users...

PT-2024-37104 · WordPress · Animated Al List Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Animated AL List WordPress plugin versions 1.0.0 through 1.0.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in t...

Malicious code in color-animated (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4915 Malicious code in color-animated (PyPI)

--- -= Per source details. Do not edit below this line.=-...

gnome: heap memory corruption on gdk-pixbuf

A flaw was found in GNOME's GdkPixbuf library, a library used to load image data in various formats used by GDK for handling graphical assets. This issue occurs when loading a crafted ANI animated cursor file file, which may lead to a heap based out-of-bounds write, causing memory corruption. Whe...

Animated AL List <= 1.0.6 - Reflected XSS

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC 1. Add a new project 2. Access the URL...

CVE-2024-5327

The PowerPack Addons for Elementor Free Widgets, Extensions and Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘ppanimatedgradientbgcolor’ parameter in all versions up to, and including, 2.7.19 due to insufficient input sanitization and output...

CVE-2024-5327

The PowerPack Addons for Elementor Free Widgets, Extensions and Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘ppanimatedgradientbgcolor’ parameter in all versions up to, and including, 2.7.19 due to insufficient input sanitization and output...

WordPress SVGator – Add Animated SVG Easily Plugin <= 1.2.6 is vulnerable to Cross Site Scripting (XSS)

Software SVGator – Add Animated SVG Easily Type Plugin Vulnerable versions = 1.2.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4271 Patch priority Low CVSS severity Low 6.5 Developer SVGator PSID 4d3427c7b584 Credits Rayhan Ramdhany...

gnome: heap memory corruption on gdk-pixbuf

A flaw was found in GNOME's GdkPixbuf library, a library used to load image data in various formats used by GDK for handling graphical assets. This issue occurs when loading a crafted ANI animated cursor file file, which may lead to a heap based out-of-bounds write, causing memory corruption. Whe...

Tencent Libpag Integer Overflow Vulnerability

Tencent Libpag is an official rendering library for PAG Portable Animated Graphics files from Tencent, a Chinese company. Tencent Libpag suffers from an integer overflow vulnerability that stems from the DecodeStream checkEndOfFile function in codec/utils/DecodeStream.cpp not correctly handling t...

CVE-2024-34408

Tencent libpag through 4.3.51 has an integer overflow in DecodeStream::checkEndOfFile in codec/utils/DecodeStream.cpp via a crafted PAG Portable Animated Graphics file...

CVE-2024-34408

Tencent libpag through 4.3.51 has an integer overflow in DecodeStream::checkEndOfFile in codec/utils/DecodeStream.cpp via a crafted PAG Portable Animated Graphics file...

North Koreans Secretly Animated Amazon and Max Shows, Researchers Say

Thousands of exposed files on a misconfigured North Korean server hint at one way the reclusive country may evade international sanctions...

MAL-2024-1212 Malicious code in @lbnqduy11805/animated-doodle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5bc261dc8812f73e104f998024da20056b718ee5c8c3c4073e13d1ee704cab6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @lbnqduy11805/animated-doodle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5bc261dc8812f73e104f998024da20056b718ee5c8c3c4073e13d1ee704cab6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-2138

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animated Box widget in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-1458

The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textalignment’ attribute of the Animated Text widget in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for...