CVE-2024-55601

Hugo, a static site generator, is affected in versions 0.123.0 through 0.139.3 (prior to 0.139.4). The issue: certain HTML attributes in Markdown in internal templates are not escaped in render hooks, specifically in templates _default/_markup/render-link.html (v0.123.0), _default/_markup/render-...

CVE-2024-55601

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are usin...

CVE-2024-55601 Hugo does not escape some attributes in internal templates

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are usin...

Hugo does not escape some attributes in internal templates

Impact Some HTML attributes in Markdown in the internal templates listed below not escaped. Impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates. default/markup/render-link.html from v0.123.0 default/markup/render-image.html from...

CVE-2024-11339

The CVE-2024-11339 entry concerns the WordPress plugin Smart PopUp Blaster. It describes a Stored Cross-Site Scripting vulnerability in the spb-button shortcode, affecting all versions up to 1.4.3, due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitatio...

CVE-2024-11779

The WIP WooCarousel Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wipwoocarouselproductscarousel' shortcode in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-11779

CVE-2024-11779 : The WIP WooCarousel Lite WordPress plugin is vulnerable to stored XSS via the shortcode wip_woocarousel_products_carousel in all versions up to 1.1.6. Authenticated attackers with contributor-level access can inject scripts that execute when users load the injected page. The CVE ...

CVE-2024-10881 LUNA RADIO PLAYER <= 6.24.11.07 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The LUNA RADIO PLAYER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lunaradio' shortcode in versions up to, and including, 6.24.11.07 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

SUSE-SU-2024:4165-1 Security update for python

This update for python fixes the following issues: - CVE-2024-11168: Fixed improper validation of IPv6 and IPvFuture addresses bsc1233307 Other fixes: - Add ipaddress module from https://github.com/phihag/ipaddress - Remove -IVendor/ from python-config bsc1231795 - Stop using %%defattr, it seems ...

CVE-2024-11769

The Flower Delivery by Florist One plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flower-delivery' shortcode in all versions up to, and including, 3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2024-11747

CVE-2024-11747 describes a Stored Cross-Site Scripting vulnerability in the WordPress plugin Responsive Videos (versions up to and including 2.1). The flaw stems from insufficient input sanitization and output escaping on attributes supplied to the plugin’s somryv shortcode. This enables authenti...

WordPress plugin多款产品 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

SUSE-SU-2024:4151-1 Security update for python

This update for python fixes the following issues: - CVE-2024-11168: Fixed improper validation of IPv6 and IPvFuture addresses bsc1233307 Other fixes: - Add ipaddress module from https://github.com/phihag/ipaddress - Remove -IVendor/ from python-config bsc1231795 - Stop using %%defattr, it seems ...

CVE-2024-11782

The WP Mailster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mstsubscribe' shortcode in all versions up to, and including, 1.8.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2024-10484

CVE-2024-10484: Spectra – WordPress Gutenberg Blocks plugin (≤2.16.2) is vulnerable to Stored XSS via the Team widget due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authentication (contributor level or higher) and can cause arbitrary ...

CVE-2024-10484 Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Team' widget in all versions up to, and including, 2.16.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

zhmcclient 安全漏洞

zhmcclient is a server interface to the zhmcclient open source. A security vulnerability exists in zhmcclient that stems from the fact that under certain circumstances, zhmcclient writes password-like attributes in plaintext to its HMC and API logs...

PT-2024-35766 · Siyuan · Siyuan

Name of the Vulnerable Software and Affected Versions: Siyuan version 3.1.11 Description: A SQL injection issue has been identified in Siyuan via the ids array parameter in the "/batchGetBlockAttrs" API endpoint. This allows for potential exploitation. Recommendations: For Siyuan version 3.1.11, ...

The vulnerability of Mozilla Convict’s library involves uncontrolled changes to object prototype attributes, allowing attackers to execute arbitrary code.

The vulnerability of the Mozilla Convict library is related to uncontrolled changes to object prototype attributes. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2024-11761

The LegalWeb Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'legalweb-popup' shortcode in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...