HCL Technologies HCL BigFix Platform Cross-Site Scripting Vulnerability

HCL Technologies HCL BigFix Platform is a suite of endpoint security management platforms from HCL Technologies, USA. The platform supports automated discovery, management and remediation of endpoint security issues. A security vulnerability exists in HCL BigFix Platform due to a missing specific...

CVE-2024-0963: Improper Neutralization of Input During Web Page Generation

The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CPCALCULATEDFIELDS shortcode in all versions up to, and including, 1.2.52 due to insufficient input sanitization and output escaping on user supplied 'location' attribute. This makes it...

PT-2024-19935

Name of the Vulnerable Software and Affected Versions HCL BigFix Platform affected versions not specified Description A cross-site scripting XSS vulnerability exists in the Web Reports component of HCL BigFix Platform due to a missing specific HTTP header attribute. Recommendations At the moment,...

CVE-2023-36496 Delegated Admin Virtual Attribute Provider Privilege Escalation

Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server...

CVE-2023-36496

The CVE-2023-36496 entry concerns PingDirectory’s Delegated Admin Privilege virtual attribute provider plugin. When enabled, it allows an authenticated user to elevate their permissions within the Directory Server, indicating a privilege-escalation flaw in the affected component. Documents refere...

CVE-2023-36496 Delegated Admin Virtual Attribute Provider Privilege Escalation

Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server...

CVE-2023-36496: Improper Privilege Management

Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server...

PT-2024-1716 · Unknown +7 · 389-Ds-Base +7

Name of the Vulnerable Software and Affected Versions: 389-ds-base affected versions not specified Description: The issue is related to a heap overflow flaw in the 389-ds-base component, specifically in the log entry attr function. This flaw can lead to a denial of service when a value larger tha...

PT-2024-6086

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a buffer overflow in the mi enum attr function of the fs/ntfs3 component in the Linux kernel. This vulnerability allows an attacker to access confidential data,...

kernel: ext4: use-after-free in ext4_xattr_set_entry()

A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw allows a privileged local user to cause a system crash or other undefined behaviors...

Fedora 39 : python-jinja2 (2024-6026572e7d)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-6026572e7d advisory. Security fix for CVE-2024-22195 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

WP Recipe Maker < 9.1.1 - Contributor+ Stored Cross-Site Scripting via 'tag'

Description The plugin is vulnerable to Stored Cross-Site Scripting via the use of the 'tag' attribute in the wprm-recipe-name, wprm-recipe-date, and wprm-recipe-counter shortcodes in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers with contributor-lev...

Enonic XP License Issues Vulnerability

Enonic XP is a free and open source web application platform and content management system based on Java and Elasticsearch from Enonic, Inc. A security vulnerability exists in Enonic XP versions prior to 7.7.4 that stems from the lack of an invalid session attribute. An attacker exploiting the...

CVE-2024-0381

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of the 'tag' attribute in the wprm-recipe-name, wprm-recipe-date, and wprm-recipe-counter shortcodes in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers wi...

PT-2024-15515

Name of the Vulnerable Software and Affected Versions WP Recipe Maker plugin for WordPress versions up to, and including, 9.1.0 Description The issue is related to Stored Cross-Site Scripting via the use of the tag attribute in the "wprm-recipe-name", "wprm-recipe-date", and "wprm-recipe-counter"...

PT-2026-60950

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 1.1.0 Description The software fails to enforce recursion depth limits when parsing nested SurrealQL statements, specifically involving IF, RELATE, and attribute access idioms. Authorized attackers can submit querie...

Cross site scripting

The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-Site Scripting attacks. Furthermore, the datauritometa AJAX action, available to all authenticated users, only had a CSRF check in place, with the nonce...

Cross Site Scripting (XSS)

jinja2 is vulnerable to Cross Site Scripting XSS. The vulnerability is due the xmlattr filter accepting keys containing spaces. The attacker can inject arbitrary HTML attribute keys and values, which would potentially lead to XSS...

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

The xmlattr filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys as opposed to only values as user input, and renders these in pages that other user...

GHSA-H5C8-RQWP-CP95 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

The xmlattr filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys as opposed to only values as user input, and renders these in pages that other user...